Temporary release method and system for WeChat applet authentication, medium and product

Abstract

The invention discloses a temporary release method and system for WeChat applet authentication, a medium and a product, and relates to the technical field of network authentication. The method comprises the following steps: when a terminal accesses a WiFi network, creating a network session for the terminal, and activating a first strategy to provide a network access entry; a multi-dimensional feature vector is formed based on target parameters in the entrance extraction network request, the multi-dimensional feature vector is matched with a preset authentication intention to obtain a confidence coefficient, and when the confidence coefficient exceeds a preset matching threshold value, the first strategy is forbidden, and the second strategy is activated; and continuously monitoring traffic data leading to the WeChat applet back-end service based on the temporary release channel, obtaining a target feature from the traffic data, when the target feature is matched with a preset verification success feature, activating a third strategy to enable the terminal to obtain a complete Internet access authority, and after a preset delay time, sending the third strategy to the WeChat applet back-end service to the WeChat applet back-end service. And asynchronously cleaning the session data of the second strategy. By implementing the technical scheme, convenient network authentication access is provided for the terminal.

Description

Technical Field

[0001] This application relates to the field of network authentication, and in particular to a temporary release method, system, medium, and product for WeChat Mini Program authentication. Background Technology

[0002] With the rapid development of internet technology, wireless networks are becoming increasingly widespread, and WiFi has become an indispensable network access method in people's daily lives and work. WeChat mini-programs, as a lightweight application, have been widely used in various fields due to their advantages such as requiring no download or installation and ease of use, further enriching the content and forms of online services.

[0003] When terminal devices connect to a WiFi network, authentication is usually required to ensure network security and management effectiveness. Traditional authentication methods mainly include username and password-based authentication, where users need to manually enter their account and password for identity verification; and SMS verification code-based authentication, where users receive a verification code after entering their mobile phone number, and complete authentication by entering the verification code.

[0004] Existing authentication methods have some obvious drawbacks. Traditional authentication methods are complex to operate, requiring users to manually enter a large amount of information. This not only increases the user's workload but also easily leads to input errors, resulting in authentication failure. Moreover, in some scenarios, users may be unable to complete authentication successfully because they forget their password or fail to receive the verification code, affecting their network usage experience. Summary of the Invention

[0005] This application provides a temporary access method, system, medium, and product for WeChat Mini Program authentication, which provides convenient network authentication access for terminals, rationally allocates network resources, and ensures network security and stability.

[0006] Firstly, this application provides a method for temporarily allowing WeChat Mini Program authentication, the method comprising: A predefined Domain Name System (DNS) policy template set is provided. The DNS policy template set includes a first policy for initial network connectivity detection of the terminal, a second policy for ensuring the operation of the WeChat Mini Program, and a third policy after successful authentication. When the terminal accesses the WiFi network, a network session is created for the terminal, the DNS policy template set is preloaded into the network session, and the first policy is activated to provide a network access entry point. Based on the entry point, real-time deep packet inspection and context association analysis are performed on all network requests sent by the terminal. Target parameters in the network requests are extracted to form a multi-dimensional feature vector. The multi-dimensional feature vector is matched with a preset authentication intent to obtain a confidence level. When the confidence level exceeds a preset matching threshold, the first strategy is disabled and the second strategy is activated to establish a temporary access channel for the WeChat mini program. Based on the temporary access channel, continuously monitor the traffic data to the WeChat Mini Program backend service, obtain target features from the traffic data, and determine whether the target features match the preset verification success features. When the target feature matches the preset verification success feature, the third strategy is activated to enable the terminal to obtain full Internet access, and after a preset delay time, the session data of the second strategy is asynchronously cleared.

[0007] By employing the above technical solution, the first strategy intelligently identifies and responds to network probe requests from different terminals, effectively inducing the terminal to display the authentication portal page, fundamentally solving the problem of authentication entry points failing to launch due to terminal differences. Utilizing deep packet inspection and context analysis technology, the system accurately identifies the user's mini-program authentication intent and automatically switches to the second strategy to establish a temporary access channel, ensuring reliable access to the network resources required by the WeChat mini-program and guaranteeing the smooth completion of the authentication process. Within the temporary access channel, multi-dimensional monitoring and feature matching are used to cross-validate the authentication success signaling from the mini-program's backend, ensuring that only genuinely successful authentication triggers final access, making the decision accurate and reliable. A delay cleanup is introduced after the switch, achieving a smooth and seamless transition from temporary access to full access, completely avoiding the unpleasant experience of network connection jitter or interruption after successful authentication.

[0008] In some embodiments, the step of performing real-time deep packet inspection and context association analysis on all network requests issued by the terminal based on the entry point, and extracting target parameters from the network requests to form a multi-dimensional feature vector, specifically includes: The network request is parsed using an application layer protocol, and heterogeneous raw parameters are obtained from the parsed header fields and payload content. The heterogeneous raw parameters include terminal type identifier, target domain name, resource path and source page. The heterogeneous raw parameters are converted into structured data objects, and the structured data objects are added to the historical request sequence corresponding to the network session in chronological order. If the source page in the network request points to the resource path of the authentication portal page in the historical request sequence, then the discrete request objects are linked into a behavioral link based on the page jump relationship. Based on the terminal type identifier, the target domain name of the request, and the resource path, a first feature sub-vector representing the static characteristics of the network request is generated. Based on the sequence of target domain names of the request contained in the behavior link, a second feature sub-vector representing the dynamic behavior sequence of the user is generated. The first feature sub-vector and the second feature sub-vector are concatenated to form the multidimensional feature vector.

[0009] By employing the above technical solution, through application layer protocol parsing and parameter structuring, heterogeneous and non-standardized data (such as headers and payloads of different formats) in the original network packets are uniformly transformed into machine-readable and meaningful structured data objects. By establishing a behavioral chain starting from the authentication portal, discrete and independent network requests initiated by users at different times are linked into a coherent and ordered sequence of operations based on their inherent page navigation logic. This enables the system to understand the user's complete operation path and intent evolution process, rather than viewing individual requests in isolation. By generating static feature sub-vectors and dynamic behavior sequence sub-vectors and concatenating them, the instantaneous features of a single request are combined with long-term behavioral pattern features across requests. This constitutes a comprehensive feature view that describes both the current state and reflects historical behavior, providing unprecedentedly rich information dimensions for accurate intent recognition.

[0010] In some embodiments, linking discrete request objects into behavioral chains based on page navigation relationships includes: Traverse the historical request sequence and determine the first request object that matches the resource path with the Uniform Resource Locator of the authentication portal page as the starting node of the behavior chain; For each request object in the historical request sequence after the starting node, verify whether the source page parameter points to the resource path corresponding to the end node of the currently constructed behavior link; If so, the currently verified request object is added as a new end node of the behavior chain; otherwise, the currently verified request object is recorded as a pending node, and a new potential behavior chain is created for the pending node. An idle duration timer is started for each of the aforementioned behavior links. If a target behavior link does not extend a new node before the idle duration timer expires, the target behavior link is determined to be invalid and removed from the context of the network session.

[0011] By adopting the above technical solution, the first request matching the authentication portal page is established as the unique starting node, creating a clear and reliable reference point for the entire behavior analysis. This ensures that all subsequent behavior analysis is performed within the correct authentication context, fundamentally avoiding interference from irrelevant traffic or erroneous sessions. By introducing a pending node and potential behavior chain mechanism, the system can handle multiple parallel operation sequences that a user might initiate (e.g., opening new tabs simultaneously). This empowers the system to identify and respond to complex, non-linear user behaviors, greatly enhancing its robustness and adaptability in real-world network environments. By setting an idle duration timer for each behavior chain and automatically cleaning up failed chains, the system achieves lifecycle management of the behavior context. This effectively prevents system resources from being occupied by outdated and obsolete session data, thereby improving the overall efficiency and accuracy of the system.

[0012] In some embodiments, matching the multidimensional feature vector with a preset authentication intent to obtain a confidence level includes: The multidimensional feature vectors are input into the Boolean decision channel, the probabilistic decision channel, and the sequence decision channel, respectively. The Boolean decision channel compares the target domain name in the multidimensional feature vector with a predefined set of key domain names and outputs a binary judgment signal. The probabilistic decision channel outputs a preliminary probability value based on the static features of the network request. The sequence decision channel outputs a sequence matching score based on the matching completeness of the behavior link with the preset authentication process template. The set of key domain names includes the official domain name required for the operation of the WeChat mini program and the feature domain name used to distinguish the network probing behavior of different terminal manufacturers. A dynamic weight is assigned to the binary determination signal, the preliminary probability value, and the sequence matching score. When the binary determination signal is true, the dynamic weight of the binary determination signal is set to the maximum value. Otherwise, the weight ratio of the preliminary probability value and the sequence matching score is adjusted according to the real-time load of the current network session. The output results of the three channels are combined into an intent confidence score according to the weighted fusion strategy. The intention confidence is smoothed to obtain an intermediate confidence level. The intermediate confidence level is then weighted and averaged with the baseline confidence level based on the current time period and the terminal's historical reputation to output the confidence level.

[0013] The above technical solution establishes three parallel decision-making channels: Boolean, probability, and sequence. These channels assess decisions based on three indispensable dimensions: deterministic rules (whether the key domain name is hit), statistical probability (static feature matching degree), and behavioral logic (completeness of the operational process). This ensures comprehensive decision-making, enabling the system to grasp hard rules, handle fuzzy situations, and understand behavioral context, forming a powerful complementary advantage. By setting a dynamic weighting rule of "one vote for the Boolean channel," a safety red line and an efficiency shortcut are established for the decision-making system. Once the key domain name is hit, a high-confidence conclusion is given directly, regardless of the results of other channels. This guarantees the absolute release of critical requests (reliability) while avoiding unnecessary complex calculations for explicit requests (high efficiency). By dynamically adjusting the weights of the probability and sequence channels based on real-time system load, an intelligent trade-off between computational accuracy and response speed is achieved. Under high load, the system favors the more efficient probability model, while under low load, it fully utilizes the more accurate but time-consuming sequence analysis, allowing the system to adapt to different operating environments and maintain optimal performance.

[0014] In some embodiments, obtaining target features from the traffic data and determining whether the target features match preset verification success features specifically includes: Within the temporary access channel, the secure link connection status of encrypted network requests and the interactive response of application network requests are monitored in parallel. When the success response packet corresponding to the interaction response is obtained, the application layer payload is parsed to extract the business status code field and the user identity identifier field. The user identity field is sent to an independent authentication and verification microservice that is decoupled from the WeChat Mini Program backend for authenticity verification, and the returned verification result is received. When the security link connection status is successful, the service status code field indicates success, and the authenticity verification result is true, the target feature is determined to match the verification success feature.

[0015] By employing the above technical solution, and through parallel monitoring of the secure link connection status (transport layer) and application interaction response (business layer), the success of the authentication process can be verified from two independent levels. With encrypted communication becoming standard, application-layer payload parsing of successful response packets directly extracts the two core business pieces of evidence: the business status code and the user's identity identifier. This allows the system to penetrate encrypted channels, accurately read and understand the internal business semantics, and provide direct evidence for judgment. By sending the user's identity identifier to an authentication and verification microservice independent of the WeChat Mini Program backend for verification, key architectural decoupling is achieved. This allows the network access system to undergo secondary confirmation through an independent, dedicated component for security verification, effectively preventing security risks caused by compromised business backends, and achieving separation of duties and enhanced security.

[0016] In some embodiments, activating the third policy to grant the terminal full internet access includes: Switch the domain name system resolution server address of the terminal from the first address serving the second policy to the public domain name system server address; Initiate a Domain Name System (DNS) resolution request for a preset public domain name to the terminal, and determine whether the terminal can obtain a response from the public domain name system server address; After confirming that the terminal can obtain a response from the public domain name system server address, the privilege level of the network session is elevated, allowing the terminal to access resources on the Internet, and the status of the network session is marked as authenticated.

[0017] By adopting the above technical solution, the terminal's network access capabilities are fundamentally changed by switching the Domain Name System (DNS) resolution address from the primary address serving the mini-program to a public DNS server. This means that the terminal can no longer only resolve specific domain names that are allowed, but can query any domain name on the Internet. This is the core operation from restricted access to full access. The system proactively initiates a probe request for public domain names to the terminal. This mechanism is used to verify whether the DNS switch has actually taken effect on the terminal, ensuring that the terminal has indeed begun using the new, fully functional DNS service.

[0018] In some embodiments, asynchronously cleaning up the session data of the second strategy after a preset delay time specifically includes: During the authentication process, network traffic of the network session is sampled at fixed time windows, and the total number of data packets in each time window is counted. The total number of data packets is compared with multiple preset threshold intervals to map to the corresponding traffic activity level. Based on the traffic activity level, a predefined negative correlation mapping table is queried to determine the delay time; An asynchronous cleanup task is initiated, starting the timer from the activation of the third strategy. Once the delay time is reached, the cleanup operation is performed to release the domain name system resolution resources occupied by the second strategy.

[0019] By adopting the above technical solution, the fixed delay time is replaced with a delay time dynamically calculated based on real-time network traffic activity, enabling the resource reclamation strategy to perceive and adapt to each user's actual usage behavior. Through a negative correlation mapping mechanism where "higher traffic activity corresponds to shorter cleanup delays," user behavior is linked to the urgency of resource reclamation. Active users are considered to have quickly completed the core authentication task and can have their resources reclaimed as soon as possible; conversely, inactive users may still be interacting slowly, requiring resources to be retained longer to prevent interruption. This demonstrates the system's context-aware intelligence. The asynchronous cleanup mechanism ensures that resource reclamation does not block the main process and does not affect the speed at which users obtain full access permissions.

[0020] In a second aspect, embodiments of this application provide a computer system including a memory, a processor, and a computer program stored in the memory; the processor executes the computer program to implement the steps of the method described in any possible implementation of the first aspect.

[0021] Thirdly, embodiments of this application provide a computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implement the steps of the method described in any possible implementation of the first aspect.

[0022] Fourthly, embodiments of this application provide a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the method described in any possible implementation of the first aspect.

[0023] It is understood that the computer system provided in the second aspect, the storage medium provided in the third aspect, and the computer program product provided in the fourth aspect are all used to execute the method provided in this application. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0024] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages: 1. By activating a primary strategy dedicated to initial network connectivity detection for terminals, it can intelligently respond to specific network detection requests from various manufacturers' terminals. Successfully inducing the terminal's operating system to believe the network is connected automatically removes restricted indicators such as exclamation marks or crosses from the WiFi icon and reliably pops up or prompts the user to open the internet authentication portal page. This provides a unified and smooth authentication starting point for all terminal users; 2. Through deep packet inspection and intelligent algorithms, the system can accurately identify the user's intent after clicking on the WeChat Mini Program authentication button. The system can automatically and immediately disable the first strategy and activate the second strategy, specifically designed to ensure the smooth operation of the WeChat Mini Program. This establishes a temporary, clean network channel, ensuring that all domain names and servers necessary for the Mini Program's operation can be accessed normally, thereby greatly improving the success rate of launching and loading the WeChat Mini Program. 3. Within the temporary access channel, proactively monitor and analyze the communication traffic between the mini-program and the backend server. It can accurately capture and parse business signaling indicating that the user has truly completed authentication from encrypted network traffic. This ensures that the system only triggers the final access operation after confirming successful user authentication, effectively preventing accidental or premature access. 4. Upon successful authentication, the third strategy is immediately activated, switching the terminal's DNS resolution to the public network server. The user instantly gains full internet access. Furthermore, through an asynchronous cleanup mechanism, the system does not immediately dismantle the temporary channel used to ensure mini-program authentication after granting full permissions; instead, it waits for a brief delay. This ensures that all network requests within the mini-program can be completed smoothly, completely avoiding any sudden interruption or error in mini-program operation due to resource cleanup at the moment full internet access is granted. Attached Figure Description

[0025] Figure 1 This is a flowchart illustrating a temporary release method for WeChat Mini Program authentication in an embodiment of this application; Figure 2 This is a schematic diagram of the process of connecting to WiFi via WeChat Mini Program in an embodiment of this application; Figure 3 This is a schematic diagram of the process of scanning a QR code to activate a mini-program and connect to WiFi in an embodiment of this application; Figure 4 This is a schematic diagram illustrating the process of a computer connecting to WiFi via a mini-program in an embodiment of this application; Figure 5 This is a schematic diagram of the cross-hotel roaming process in an embodiment of this application; Figure 6 This is a schematic diagram of an exemplary hardware structure of a computer system in an embodiment of this application. Detailed Implementation

[0026] The terminology used in the following embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification and appended claims of this application, the singular expressions “a,” “an,” “the,” “the,” “the,” and “this” are intended to include the plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this application refers to any or all possible combinations including one or more of the listed items.

[0027] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0028] The following is combined Figure 1 The method of the embodiments of this application will be described below.

[0029] Figure 1 This is a flowchart illustrating a temporary release method for WeChat Mini Program authentication in an embodiment of this application, as shown below. Figure 1 As shown, a temporary approval method for WeChat Mini Program authentication includes the following steps: S101. A predefined Domain Name System (DNS) policy template set, which includes a first policy for initial network connectivity detection of the terminal, a second policy for ensuring the operation of the WeChat mini program, and a third policy after successful authentication. When the terminal accesses the WiFi network, a network session is created for the terminal, the DNS policy template set is preloaded into the network session, and the first policy is activated to provide a network access entry. S102. Based on the entry point, perform real-time deep packet inspection and context association analysis on all network requests sent by the terminal, extract target parameters from the network requests to form a multi-dimensional feature vector, match the multi-dimensional feature vector with a preset authentication intent to obtain a confidence level, and when the confidence level exceeds a preset matching threshold, disable the first strategy and activate the second strategy to establish a temporary access channel for the WeChat mini program. S103. Based on the temporary access channel, continuously monitor the traffic data to the WeChat Mini Program backend service, obtain the target feature from the traffic data, and determine whether the target feature matches the preset verification success feature. S104. When the target feature matches the preset verification success feature, the third strategy is activated to enable the terminal to obtain full Internet access, and after a preset delay time, the session data of the second strategy is asynchronously cleared.

[0030] Predefined policy template set: At the system level, a set of DNS (Domain Name System) policies with three different purposes are pre-configured. First policy (Activity Detection Policy): The core is a "domain-IP" mapping table containing specific domains used by major terminal manufacturers (such as Vivo, OPPO, Xiaomi, Huawei / Honor, etc.) to check network connectivity. Second policy (Mini Program Protection Policy): Includes all official and business domains necessary for the normal operation of WeChat Mini Programs. Third policy (Global Allow Policy): This is the normal public DNS resolution policy. When a user's mobile phone or other terminal connects to WiFi, the network-side system creates an independent network session for it, similar to creating a separate file folder. The system loads the above policy template set into this session and immediately activates the first policy. At this time, when the terminal's operating system sends network connectivity detection requests to the manufacturer's server, these requests are captured by the first policy, and their domain names are resolved to a preset, accessible IP address. This action makes the terminal's operating system believe that the network is working, so the exclamation mark or cross on the terminal's WiFi icon disappears, the status bar shows that WiFi is connected, and the internet authentication portal page can be automatically popped up or manually called up. After a user sees the authentication portal page and performs an operation, the system monitors and deeply analyzes all HTTP (Hypertext Transfer Protocol) / HTTPS (Hypertext Transfer Protocol Secure) requests sent by the terminal in real time. It extracts key parameters such as User-Agent (identifying the terminal type), Host (target domain name), URL (Uniform Resource Locator) path, and Referer. These parameters are then fused into a multi-dimensional feature vector and matched against an authentication intent fingerprint database. This matching process calculates a confidence level to quantify the likelihood that the current request is the user attempting to initiate WeChat Mini Program authentication. When the confidence level exceeds a preset threshold (e.g., 90%), the system determines that the user's intent is clear. At this point, the system immediately disables the first strategy and activates the second strategy. The activation of the second strategy means that the system has established a temporary passage for the operation of the WeChat Mini Program. Within this passage, all necessary network access, such as connecting to the WeChat server, downloading code, and calling APIs (Application Programming Interfaces), can be correctly allowed, thus ensuring that the WeChat Mini Program can load and run normally, complete the authentication process, and effectively solve the problem of Mini Program launch failure. The system continuously monitors network traffic passing through this channel to the WeChat Mini Program's backend service. When a user completes actions such as granting permission to access information within the Mini Program and submits the request, the Mini Program backend returns a successful authentication signal. The system uses deep packet inspection technology to capture and parse specific authentication success characteristics from the returned traffic data. This characteristic might be a specific HTTP success status code, a "success" identifier carried in the response payload, or an encrypted security token.Once authentication is successful, the system immediately activates the third policy. This means the system disables the dedicated DNS routing function set up for temporary access and switches the terminal's DNS server to a normal public DNS. The terminal now has full internet access and can freely browse any website. Simultaneously with activating the third policy, the system starts a timer. After a preset delay (e.g., 2-5 seconds), it asynchronously cleans up session data and cache rules related to the second policy. This delayed cleanup is a key design feature to ensure a good user experience. It ensures that any small number of network requests that may still be in progress within the mini-program during the permission switch can be completed smoothly, fundamentally avoiding the phenomenon of "the mini-program reporting errors or lagging after successful authentication." After cleanup, system resources are released, and the user session enters a stable and clean authenticated state.

[0031] In some embodiments, the step of performing real-time deep packet inspection and context association analysis on all network requests issued by the terminal based on the entry point, and extracting target parameters from the network requests to form a multi-dimensional feature vector, specifically includes: The network request is parsed using an application layer protocol, and heterogeneous raw parameters are obtained from the parsed header fields and payload content. The heterogeneous raw parameters include terminal type identifier, target domain name, resource path and source page. The heterogeneous raw parameters are converted into structured data objects, and the structured data objects are added to the historical request sequence corresponding to the network session in chronological order. If the source page in the network request points to the resource path of the authentication portal page in the historical request sequence, then the discrete request objects are linked into a behavioral link based on the page jump relationship. Based on the terminal type identifier, the target domain name of the request, and the resource path, a first feature sub-vector representing the static characteristics of the network request is generated. Based on the sequence of target domain names of the request contained in the behavior link, a second feature sub-vector representing the dynamic behavior sequence of the user is generated. The first feature sub-vector and the second feature sub-vector are concatenated to form the multidimensional feature vector.

[0032] The system parses each HTTP / HTTPS request sent by the terminal, stripping away the communication protocol shell to directly obtain the information carried internally. From the parsed request, it extracts various types of heterogeneous raw information, including the terminal type identifier, the target domain name, the resource path, and the source page. Terminal type identifier: Primarily parsed from the User-Agent header field, it indicates whether the request originates from a specific brand and model of mobile phone, such as Vivo, OPPO, Xiaomi, or Huawei / Honor. This is fundamental to understanding the behavioral differences between different terminal devices. Target domain name: Obtained from the Host header field, this indicates the target server object the terminal is attempting to access, such as connect.vivo.com.cn (Vivo liveness detection server) or wx.qlogo.cn (WeChat avatar server). Resource path: The path portion of the URL specifies the specific resource or interface requested on the server, such as the main HTML file of a portal page ( / portal / index.html) or an authentication API ( / auth / api / login). Source page: Obtained from the Referer header field, this is crucial for contextual association and indicates the origin of the current request. The extracted, disorganized raw parameters are uniformly encapsulated into a data structure (object) with a fixed format that is easy for machines to process. Each structured request object is added sequentially to a list specific to the current network session, based on its timestamp. This list constitutes a complete and ordered operation log of the user since connecting to WiFi, providing a temporal context for subsequent analysis. The system checks whether the source page of the current request points to the resource path of the request that has been confirmed as the "authentication portal page" in the historical request sequence. If the above judgment is true, it means that the current request was triggered by the user from the authentication portal page. The system links this discrete request object to the request chain starting from the portal page based on this page jump relationship, thus forming a continuously growing behavior chain. The system integrates all the information collected and processed above to generate the final feature vector used for intelligent decision-making. The first feature sub-vector (static feature) is generated based on parameters such as terminal type identifier, request target domain name, and resource path. It depicts a static snapshot of a single request. The second feature sub-vector (dynamic behavior sequence feature) is generated based on the request target domain name sequence contained in the behavior chain. This sequence describes the domains a user visits sequentially, starting from the initial point. It characterizes the user's dynamic behavior patterns and operating habits. For example, a sequence like "portal page domain → WeChat official domain" strongly suggests the intent of WeChat mini-program authentication. Concatenating these two sub-vectors forms a final, information-rich, multi-dimensional feature vector.Through this series of processes, the system successfully elevates the underlying network data packets into a high-level behavioral intent representation containing semantics.

[0033] In some embodiments, linking discrete request objects into behavioral chains based on page navigation relationships includes: Traverse the historical request sequence and determine the first request object that matches the resource path with the Uniform Resource Locator of the authentication portal page as the starting node of the behavior chain; For each request object in the historical request sequence after the starting node, verify whether the source page parameter points to the resource path corresponding to the end node of the currently constructed behavior link; If so, the currently verified request object is added as a new end node of the behavior chain; otherwise, the currently verified request object is recorded as a pending node, and a new potential behavior chain is created for the pending node. An idle duration timer is started for each of the aforementioned behavior links. If a target behavior link does not extend a new node before the idle duration timer expires, the target behavior link is determined to be invalid and removed from the context of the network session.

[0034] The system scans (traverses) all historical request sequences recorded for the session from beginning to end, searching for the first request whose "resource path" exactly matches the known authentication portal page URL. This precisely anchors the starting point of the user's authentication journey amidst the chaotic history. In the standard process, all subsequent authentication actions should originate from this visit to the portal page. Identifying this request as the "starting node" ensures that all subsequent analysis is built on the correct context. This avoids misjudging irrelevant, accidental, or browser-preloaded requests as the starting point, guaranteeing the purity of the action chain's theme. From the starting node onwards, for each subsequent request in the historical sequence, the system performs a crucial check: verifying that the current request's "source page" parameter precisely points to the "resource path" of the last node (i.e., the end node) in the currently constructed action chain. It also verifies whether the current request was directly triggered by the user on the previous action page. This ensures that each link in the action chain has a clear causal and redirection relationship, reconstructing the user's true action path. For example, suppose the current end node of the link is the portal page portal / index.html, and a subsequent request loads an image static / button.png from the same page, portal / index.html; in this case, the validation passes. If the next request's source page is still portal / index.html, it means it was also directly triggered by the portal page. If the validation passes, it means the request is a natural continuation of the current behavior link. The system will append it as a new end node to the existing link, allowing the link to grow forward. If the validation fails, it means the request is disconnected from the current main behavior link. This could be because the user opened a new browser tab, clicked a button on the page pointing to an external link, or some kind of asynchronous loading. The system will not simply discard this request but will record it as a "pending node." Simultaneously, a new "potential behavior link" is created starting from this "pending node." For the main link, the system ensures its logical coherence and accuracy. For abnormal jumps, it has fault tolerance and parallel processing capabilities. The system acknowledges that user behavior may have multiple lines and opens independent analysis channels for these potential new sequences, greatly enhancing robustness in complex real-world network environments. The system assigns an idle timer to each action link (including the main link and all potential links). This timer resets whenever a new node is successfully added to the link. If a link fails to add a new node before the timer expires, the system determines that the link has failed (the user has abandoned the operation) and removes it from the session context. This timely release of memory and computing resources prevents the system from being overwhelmed by a large number of abandoned and outdated links.

[0035] In some embodiments, matching the multidimensional feature vector with a preset authentication intent to obtain a confidence level includes: The multidimensional feature vectors are input into the Boolean decision channel, the probabilistic decision channel, and the sequence decision channel, respectively. The Boolean decision channel compares the target domain name in the multidimensional feature vector with a predefined set of key domain names and outputs a binary judgment signal. The probabilistic decision channel outputs a preliminary probability value based on the static features of the network request. The sequence decision channel outputs a sequence matching score based on the matching completeness of the behavior link with the preset authentication process template. The set of key domain names includes the official domain name required for the operation of the WeChat mini program and the feature domain name used to distinguish the network probing behavior of different terminal manufacturers. A dynamic weight is assigned to the binary determination signal, the preliminary probability value, and the sequence matching score. When the binary determination signal is true, the dynamic weight of the binary determination signal is set to the maximum value. Otherwise, the weight ratio of the preliminary probability value and the sequence matching score is adjusted according to the real-time load of the current network session. The output results of the three channels are combined into an intent confidence score according to the weighted fusion strategy. The intention confidence is smoothed to obtain an intermediate confidence level. The intermediate confidence level is then weighted and averaged with the baseline confidence level based on the current time period and the terminal's historical reputation to output the confidence level.

[0036] The system simultaneously feeds a multi-dimensional feature vector representing network behavior into three independent decision channels for analysis, each providing opinions from different dimensions. The Boolean decision channel focuses solely on the "request target domain" within the feature vector, precisely matching this domain against a predefined set of key domains. This set includes official WeChat mini-program domains and terminal manufacturer activity detection domains. Official WeChat mini-program domains include wx.qlogo.cn and res.wx.qq.com. Matching these domains provides strong evidence of authentication intent. Terminal manufacturer activity detection domains include connect.vivo.com.cn and cp.cloud.oppo.com. Matching these domains, combined with context, can be used to identify terminal types and eliminate interference. The Boolean decision channel outputs a binary (True or False) signal; if a key domain in the whitelist is matched, it immediately outputs True (representing strong affirmation); otherwise, it outputs False. The probabilistic decision channel primarily analyzes static features in the feature vector (such as terminal type and resource paths of a single request). It is typically a trained machine learning model (such as a classifier) ​​that calculates the matching degree between these features and historical authentication behavior data. The probabilistic decision channel outputs a preliminary probability value between 0 and 1, which indicates "how likely it is to be an authentication intent based solely on the instantaneous features of the current request." The sequence decision channel analyzes the behavioral chain, that is, a series of coherent actions by the user starting from the portal page. It compares the actual request domain sequence with a preset authentication process template. This template defines the ideal steps for successfully launching the mini-program, for example: [portal page domain] → [WeChat JS-SDK resource domain] → [mini-program dedicated business domain]. The sequence decision channel outputs a sequence matching score. The closer the user's actual operation sequence matches the standard template, the higher the score. It can effectively identify abnormal behaviors that appear normal individually but illogical when combined. If the boolean channel outputs True (hitting the key domain), it is given the highest weight, directly influencing the final conclusion. This is because hard rules have the highest authority and reliability. If the boolean channel outputs False, the weights of the probabilistic decision channel and the sequence decision channel are dynamically adjusted according to the current real-time system load. Under high load: Prioritize efficiency, increasing the weight of probability channels with faster computation speed. Under low load: Prioritize accuracy, increasing the weight of sequence channels that provide deeper and more accurate analysis. Based on the set weights, the output values ​​of the three channels are weighted and calculated to form a unified intent confidence score. This value initially reflects the system's overall judgment of the authentication intent. The intent confidence score is then input into a signal smoothing filter (such as a moving average filter) to eliminate confidence score spikes caused by accidental factors such as network jitter and browser preloading, resulting in a more stable and reliable intermediate confidence score.The smoothed median confidence level is then weighted and averaged with a baseline confidence level. The baseline confidence level is related to the current time period and the terminal's historical reputation. For example, requests from unfamiliar terminals late at night will have a lower baseline confidence level, indicating greater caution; if the device has a history of successful authentication, its baseline confidence level will be higher. The final calibrated confidence level is then compared with a preset threshold to determine whether to trigger a policy switch.

[0037] In some embodiments, obtaining target features from the traffic data and determining whether the target features match preset verification success features specifically includes: Within the temporary access channel, the secure link connection status of encrypted network requests and the interactive response of application network requests are monitored in parallel. When the success response packet corresponding to the interaction response is obtained, the application layer payload is parsed to extract the business status code field and the user identity identifier field. The user identity field is sent to an independent authentication and verification microservice that is decoupled from the WeChat Mini Program backend for authenticity verification, and the returned verification result is received. When the security link connection status is successful, the service status code field indicates success, and the authenticity verification result is true, the target feature is determined to match the verification success feature.

[0038] Monitoring the secure connection status of encrypted network requests: This monitors all encrypted network requests based on protocols such as HTTPS to determine if a TLS secure link has been successfully established between the terminal and the WeChat server. This is accomplished by capturing and analyzing specific signaling sequences in the TLS handshake protocol (such as Client Hello, Server Hello, Change Cipher Spec, Finished). Monitoring the interactive responses of application-related network requests: This monitors specific business requests between the terminal and the WeChat Mini Program backend service (such as API calls for submitting phone numbers or verification codes). Specifically, it captures the HTTP response packets returned by the server after these business requests are completed. When an interactive response is detected and confirmed to be a successful response packet (e.g., HTTP status code 200), the system parses the payload of the response packet. This payload is typically a JSON or XML data body containing detailed results of the business execution. Key fields are extracted from the successful response packet, including the business status code field and the user identification field. Business status code field: Fields such as "code": 0 or "status": "success" are parsed from the payload. This code is more specific than an HTTP status code, defined by the WeChat Mini Program's business logic, explicitly indicating whether authentication succeeded or failed at the business level. The user identity field: This also parses out the unique user identifier associated with this successful authentication, such as an encrypted OpenID, UnionID, or session token. The system sends the user identity field returned by the Mini Program backend to an authentication verification microservice independent of the WeChat Mini Program backend. This independent microservice performs cryptographic verification on the token, checks its validity and signature, ensuring it is authentic, legitimate, and not expired. Finally, the system summarizes the evidence collected in the first three steps and executes a logical judgment. Authentication is only considered successful if the following three conditions are met simultaneously: the secure link connection status is successful, ensuring the communication channel itself is secure and connected; the business status code field indicates success, ensuring the WeChat Mini Program's business logic confirms the authentication operation was successful; and the authenticity verification result is true, ensuring the token representing the user's identity is authentic and valid.

[0039] In some embodiments, activating the third policy to grant the terminal full internet access includes: Switch the domain name system resolution server address of the terminal from the first address serving the second policy to the public domain name system server address; Initiate a Domain Name System (DNS) resolution request for a preset public domain name to the terminal, and determine whether the terminal can obtain a response from the public domain name system server address; After confirming that the terminal can obtain a response from the public domain name system server address, the privilege level of the network session is elevated, allowing the terminal to access resources on the Internet, and the status of the network session is marked as authenticated.

[0040] The terminal's DNS server address is switched from the "first address" serving the second policy to a public DNS server address. During the second policy's duration, the terminal's DNS queries are directed to a dedicated, internal DNS server (the first address). This server acts like a dedicated navigation service that only indexes locations relevant to WeChat; it can only correctly resolve the domains necessary for the WeChat mini-program to function. For any other internet domain, it may fail to resolve or resolve to an incorrect address. To grant the terminal full internet access, its DNS queries must be handed over to a global public navigation service that indexes all website addresses—the public DNS server. This is the core operation of the access escalation. Through this switch, the terminal can now obtain the correct IP address for any legitimate domain on the internet, a prerequisite for accessing these resources. After switching the DNS configuration, the system does not passively wait but actively initiates a DNS resolution request for the preset public domain to the terminal and determines whether the terminal can obtain a correct response from the new public DNS server. This step verifies whether the switch operation has truly taken effect on the terminal. Due to DNS caching, network latency, or configuration push failures, the terminal's actual DNS resolution behavior may not change immediately. The system sends a DNS resolution request to the terminal for a known public domain name (such as www.example.com or www.qq.com) and listens for the response. If the IP address returned by the terminal is the correct address from the public DNS, the switch is successful; if the returned address is still the old internal DNS address or the resolution fails, the switch has not taken effect. After confirming that the DNS switch has taken effect, the system elevates the privilege level of the network session: at the system's policy enforcement point, the privilege flag for that specific network session is upgraded from temporary access to full access. This means that the network device will allow the IP packets of this session to access any IP address on the Internet, no longer limited to IPs in the previous whitelist. The terminal is allowed to access resources on the Internet: this is the direct manifestation of the privilege elevation. From now on, any application on the terminal, such as browsers and apps, can freely establish connections and exchange data with any server on the Internet. The network session's status is marked as authenticated: in the system's session manager, the session's status field is updated to authenticated. This signifies that the user has completed the entire authentication and access process.

[0041] In some embodiments, asynchronously cleaning up the session data of the second strategy after a preset delay time specifically includes: During the authentication process, network traffic of the network session is sampled at fixed time windows, and the total number of data packets in each time window is counted. The total number of data packets is compared with multiple preset threshold intervals to map to the corresponding traffic activity level. Based on the traffic activity level, a predefined negative correlation mapping table is queried to determine the delay time; An asynchronous cleanup task is initiated, starting the timer from the activation of the third strategy. Once the delay time is reached, the cleanup operation is performed to release the domain name system resolution resources occupied by the second strategy.

[0042] The system performs "snapshot" sampling of all network traffic belonging to a given network session at fixed time windows (e.g., every 30 seconds). Within each time window, the system doesn't concern itself with the specific content of the data packets, but simply counts the total number of data packets flowing through the session. This is a low-level network metric that effectively reflects the frequency of user interaction. The counted number of data packets is compared with several preset threshold ranges. For example: [0-10) packets / window → low activity; [10-100) packets / window → medium activity; [100+) packets / window → high activity. This step transforms abstract user behavior into an objective, quantifiable traffic activity level. This is like creating a dynamic profile of the user's network usage habits; high activity means the user is frequently interacting with the mini-program (e.g., downloading resources, making multiple API calls), while low activity may mean the user is reading a static page or the operation is nearing completion. Based on the determined traffic activity level, the system queries a predefined negative correlation mapping table to determine a specific delay time. Examples of negative correlation mapping: High activity → shorter latency (e.g., T_high = 2 seconds); Medium activity → medium latency (e.g., T_medium = 5 seconds); Low activity → longer latency (e.g., T_low = 10 seconds). For highly active users, the system judges that they may be completing the authentication process quickly and intensively. Therefore, after successful authentication, the waiting time can be shortened more aggressively to reclaim resources as soon as possible and improve system efficiency. For low-activity users, the system judges that their operation pace is slow, and there may still be unfinished requests or requests about to be initiated after successful authentication. Therefore, the waiting time needs to be extended more conservatively to prioritize the continuity of their experience and avoid network errors within the mini-program due to premature resource reclamation. While activating the third strategy (i.e., the terminal has obtained full internet access permissions), the system starts an asynchronous cleanup task in the background and begins timing. Asynchronous means that this task will not block the main process, and the user's internet access will not be affected in any way. Delayed execution: The system will wait until the timer reaches the dynamic latency calculated in the second step. Once the time is up, the cleanup task is executed, releasing the dedicated DNS resolution resources occupied by the second strategy. This includes unbinding the session from the internal DNS server and cleaning up related routing rules or session entries. The core purpose of introducing the delay is to provide a safe buffer period. During this time, the second strategy (dedicated channel for the mini-program) and the third strategy (global internet channel) are in effect simultaneously. This ensures that the moment a user gains full internet access, any requests within their mini-program that may still be in progress (such as uploading images or final confirmation) can be successfully completed using the temporary channel, achieving an absolutely smooth and seamless transition from temporary access to full access.Compared to using a fixed, long delay time set for safety, this activity-based dynamically calculated delay can reclaim resources earlier in most cases, thus significantly improving the system's resource utilization efficiency without sacrificing user experience.

[0043] Figure 2 This is a schematic diagram of the process of connecting to WiFi via WeChat Mini Program in an embodiment of this application, such as... Figure 2 As shown, after a guest connects to the hotel's Wi-Fi, their phone automatically pops up an authentication portal page. On this page, the guest clicks "Connect to Wi-Fi via WeChat Mini Program." The system launches the WeChat Mini Program, and the guest allows it to access their phone number. A membership registration page is then displayed, prompting the guest to enter their surname, first name, email address, and other information. The Mini Program displays a membership registration form, requiring the guest to supplement their personal information. The system checks if the guest is already a hotel member based on their phone number: Yes → Proceed directly to the next authentication step; No → Proceed to the next step to determine if they wish to register. The system determines if the guest is willing to register as a member: Yes → Submit a membership registration request, and continue authentication after successful registration; No → Proceed directly to the authentication process. If the guest chooses to register, the system submits their information to the membership system via an interface, completing the registration. After successful authentication, the page redirects to a completion page within the Mini Program, indicating that the guest has successfully connected to the Wi-Fi. The system records the guest's identity information and device MAC address, allowing them to roam within the group's hotels for 180 days without needing to re-authenticate.

[0044] Figure 3 This is a schematic diagram illustrating the process of scanning a QR code to activate a mini-program and connect to WiFi in an embodiment of this application. Figure 3 As shown, guests scan a specific WeChat official account QR code, follow it, and automatically receive a message containing a card for "WeChat Mini Program Wi-Fi Connection." Clicking this card initiates the authentication process. Alternatively, guests can directly scan a dedicated QR code for the mini program, instantly launching it and skipping the official account follow step. Either method redirects to the WeChat mini program, requesting permission to access the guest's phone number. The mini program displays the membership agreement and guides the guest to register. The system determines if the guest is already a member based on their phone number: Yes → submits an authentication request directly; No → prompts the customer to register. The system asks if the guest wishes to register immediately: Yes → submits a membership registration request via API, proceeding to the authentication step upon successful registration; No → proceeds directly to the authentication step. After member verification, the system submits a network access authentication request. Upon success, the page redirects to the mini program's completion page. (Branch Step) If the guest chooses to register, the system completes the submission of membership information at this step. After successful authentication, the system records the user's identity and device information, eliminating the need for repeated authentication within 180 days at hotels under the group's umbrella.

[0045] Figure 4 This is a schematic diagram illustrating the process of a computer connecting to WiFi via a mini-program in an embodiment of this application, as shown below. Figure 4 As shown, after the computer connects to Wi-Fi, an authentication page pops up. The guest scans the QR code on the page with their mobile phone (using 4G data). The phone will be redirected to a WeChat mini-program and asked to obtain the phone number. The system then determines whether the phone number has internet access permission. If it does not have internet access, an interface will pop up on the phone asking the guest to allow the computer to access the internet. After the guest confirms permission, the computer can successfully access the internet. At the same time, the system will execute the membership status judgment and registration process in parallel, guiding non-member guests to complete membership registration.

[0046] Figure 5 This is a schematic diagram of the cross-hotel roaming process in an embodiment of this application, such as... Figure 5 As shown, when a guest checks into a hotel under the group again and connects to Wi-Fi, the system will first check whether their terminal device is within the 180-day roaming validity period. If they have registered for roaming, the system will automatically identify their identity, complete the registration at the current hotel, and directly allow them to access the Internet, achieving seamless authentication. If they have not registered or their roaming has expired, the system will guide the guest to re-authenticate (such as through WeChat mini-program authentication) to restore their Internet access and roaming status.

[0047] The above describes a temporary release method for WeChat mini-program authentication in the embodiments of this application. The computer system in the embodiments of this application will be described in detail below in conjunction with the above temporary release method for WeChat mini-program authentication.

[0048] Please see Figure 6 This is a schematic diagram of an exemplary hardware structure of a computer system in an embodiment of this application.

[0049] In some embodiments, the computer system 600 includes a computer device, which may be a terminal device. The computer device includes a processor 601, a memory 602, a sensor module 603, a communication module 604, an input device 605, and an output device 606 connected via a system bus. The processor 601 of the computer device provides computing and control capabilities. The memory 602 of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database is used to store data.

[0050] Those skilled in the art will understand that Figure 6The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0051] In some embodiments of this application, a computer-readable storage medium is provided, including instructions that, when executed on a computer system 600, cause the computer system 600 to execute a temporary release method for WeChat mini-program authentication according to an embodiment of this application.

[0052] In some embodiments of this application, a computer program product is also provided, which, when running on a computer system 600, causes the computer system 600 to execute a temporary release method for WeChat mini-program authentication according to an embodiment of this application.

[0053] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0054] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive), etc.

[0055] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A method for temporarily allowing WeChat Mini Program authentication, characterized in that, include: A predefined Domain Name System (DNS) policy template set is provided. The DNS policy template set includes a first policy for initial network connectivity detection of the terminal, a second policy for ensuring the operation of the WeChat Mini Program, and a third policy after successful authentication. When the terminal accesses the WiFi network, a network session is created for the terminal, the DNS policy template set is preloaded into the network session, and the first policy is activated to provide a network access entry point. Based on the entry point, real-time deep packet inspection and context association analysis are performed on all network requests sent by the terminal. Target parameters in the network requests are extracted to form a multi-dimensional feature vector. The multi-dimensional feature vector is matched with a preset authentication intent to obtain a confidence level. When the confidence level exceeds a preset matching threshold, the first strategy is disabled and the second strategy is activated to establish a temporary access channel for the WeChat mini program. Based on the temporary access channel, continuously monitor the traffic data to the WeChat Mini Program backend service, obtain target features from the traffic data, and determine whether the target features match the preset verification success features. When the target feature matches the preset verification success feature, the third strategy is activated to enable the terminal to obtain full Internet access, and after a preset delay time, the session data of the second strategy is asynchronously cleared.

2. The temporary release method for WeChat Mini Program authentication according to claim 1, characterized in that, The process of performing real-time deep packet inspection and contextual analysis on all network requests issued by the terminal based on the entry point, and extracting target parameters from the network requests to form a multi-dimensional feature vector, specifically includes: The network request is parsed using an application layer protocol, and heterogeneous raw parameters are obtained from the parsed header fields and payload content. The heterogeneous raw parameters include terminal type identifier, target domain name, resource path and source page. The heterogeneous raw parameters are converted into structured data objects, and the structured data objects are added to the historical request sequence corresponding to the network session in chronological order. If the source page in the network request points to the resource path of the authentication portal page in the historical request sequence, then the discrete request objects are linked into a behavioral link based on the page jump relationship. Based on the terminal type identifier, the target domain name of the request, and the resource path, a first feature sub-vector representing the static characteristics of the network request is generated. Based on the sequence of target domain names of the request contained in the behavior link, a second feature sub-vector representing the dynamic behavior sequence of the user is generated. The first feature sub-vector and the second feature sub-vector are concatenated to form the multidimensional feature vector.

3. The temporary release method for WeChat Mini Program authentication according to claim 2, characterized in that, The step of linking discrete request objects into behavioral chains based on page navigation relationships includes: Traverse the historical request sequence and determine the first request object that matches the resource path with the Uniform Resource Locator of the authentication portal page as the starting node of the behavior chain; For each request object in the historical request sequence after the starting node, verify whether the source page parameter points to the resource path corresponding to the end node of the currently constructed behavior link; If so, the currently verified request object is added as a new end node of the behavior chain; otherwise, the currently verified request object is recorded as a pending node, and a new potential behavior chain is created for the pending node. An idle duration timer is started for each of the aforementioned behavior links. If a target behavior link does not extend a new node before the idle duration timer expires, the target behavior link is determined to be invalid and removed from the context of the network session.

4. The temporary release method for WeChat Mini Program authentication according to claim 3, characterized in that, The step of matching the multidimensional feature vector with the preset authentication intent to obtain the confidence level includes: The multidimensional feature vectors are input into the Boolean decision channel, the probabilistic decision channel, and the sequence decision channel, respectively. The Boolean decision channel compares the target domain name in the multidimensional feature vector with a predefined set of key domain names and outputs a binary judgment signal. The probabilistic decision channel outputs a preliminary probability value based on the static features of the network request. The sequence decision channel outputs a sequence matching score based on the matching completeness of the behavior link with the preset authentication process template. The set of key domain names includes the official domain name required for the operation of the WeChat mini program and the feature domain name used to distinguish the network probing behavior of different terminal manufacturers. A dynamic weight is assigned to the binary determination signal, the preliminary probability value, and the sequence matching score. When the binary determination signal is true, the dynamic weight of the binary determination signal is set to the maximum value. Otherwise, the weight ratio of the preliminary probability value and the sequence matching score is adjusted according to the real-time load of the current network session. The output results of the three channels are combined into an intent confidence score according to the weighted fusion strategy. The intention confidence is smoothed to obtain an intermediate confidence level. The intermediate confidence level is then weighted and averaged with the baseline confidence level based on the current time period and the terminal's historical reputation to output the confidence level.

5. The temporary release method for WeChat Mini Program authentication according to claim 1, characterized in that, The step of obtaining target features from the traffic data and determining whether the target features match preset verification success features specifically includes: Within the temporary access channel, the secure link connection status of encrypted network requests and the interactive response of application network requests are monitored in parallel. When the success response packet corresponding to the interaction response is obtained, the application layer payload is parsed to extract the business status code field and the user identity identifier field. The user identity field is sent to an independent authentication and verification microservice that is decoupled from the WeChat Mini Program backend for authenticity verification, and the returned verification result is received. When the security link connection status is successful, the service status code field indicates success, and the authenticity verification result is true, the target feature is determined to match the verification success feature.

6. The temporary release method for WeChat Mini Program authentication according to claim 5, characterized in that, Activating the third strategy to grant the terminal full internet access includes: Switch the domain name system resolution server address of the terminal from the first address serving the second policy to the public domain name system server address; Initiate a Domain Name System (DNS) resolution request for a preset public domain name to the terminal, and determine whether the terminal can obtain a response from the public domain name system server address; After confirming that the terminal can obtain a response from the public domain name system server address, the privilege level of the network session is elevated, allowing the terminal to access resources on the Internet, and the status of the network session is marked as authenticated.

7. The method according to claim 1, characterized in that, The step of asynchronously clearing the session data of the second strategy after a preset delay time specifically includes: During the authentication process, network traffic of the network session is sampled at fixed time windows, and the total number of data packets in each time window is counted. The total number of data packets is compared with multiple preset threshold intervals to map to the corresponding traffic activity level. Based on the traffic activity level, a predefined negative correlation mapping table is queried to determine the delay time; An asynchronous cleanup task is initiated, starting the timer from the activation of the third strategy. Once the delay time is reached, the cleanup operation is performed to release the domain name system resolution resources occupied by the second strategy.

8. A computer system comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method according to any one of claims 1-7.

9. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method described in any one of claims 1-7.

10. A computer program product, comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method described in any one of claims 1-7.

Images