Keystroke continuous identity verification method based on keyboard position function coding and attention

Abstract

The invention discloses a keystroke continuous identity verification method based on keyboard position function coding and attention, and belongs to the technical field of information. The method comprises the specific steps that firstly, user keystroke data are collected, vectorization processing is conducted on the keystroke data, then feature expansion is conducted on the keystroke data through keyboard function position coding, the keystroke data are divided into input data of three sequence lengths through a multi-sliding sequence method, and the input data are input into a neural network model; the neural network model is trained based on input data, a click rhythm is extracted through a feature attention module and a rhythm attention module, and a model output probability is obtained through an activation function; in an identity verification stage, keystroke data is collected in real time and vectorized, then the trained neural network model is input to obtain an output probability, and then a continuous verification algorithm based on time weighting, dynamic fluctuation and confidence evaluation is used to adjust the output probability to obtain a final identity verification probability.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of information technology, and relates to a keystroke duration identity authentication method based on keyboard position function coding and attention. BACKGROUND

[0002] In today's deep integration of informatization and digitization, remote office, cloud computing, Internet of Things and other technologies are widely popularized, user device access scenarios are increasingly complex, and information encryption and identity authentication technology, as the two main pillars of information security defense, is becoming increasingly important, and identity authentication plays an important role as the first protection.

[0003] Static password is the most widely used identity authentication method in life. Users often use simple combinations such as "name + birthday" and "common words + numbers" for easy memorization, but such passwords can be cracked within a few hours through dictionary attacks, which is high-risk. Even if a high-strength complex password is used, it may still be stolen due to phishing websites and other intermediate attack methods. The second is to provide protection through physical devices or communication links, but there is a certain contradiction between its application cost and user experience: hardware tokens need to be carried separately and are easy to lose, and SMS verification codes are subject to network delay and signal coverage, and are completely broken after the phone is lost. Biological factors rely on the uniqueness of their physiological characteristics to achieve high-precision identity authentication, but how to ensure verification accuracy while avoiding privacy invasion is a problem that biological factors need to solve. In addition, the deployment of biological recognition on the desktop faces some difficulties: the hardware cost of special sensors such as fingerprint modules and infrared cameras limits their popularization in small and medium-sized enterprises and individual users, and the preconditions are many, lacking applicability and portability. These traditional solutions that rely on "single-point one-time verification" are difficult to cope with continuous security threats, as they only confirm identity at the moment of login, but cannot cope with identity impersonation risks in subsequent operations, and need to build a protection mechanism deeply bound to user operation behavior.

[0004] When facing complex intrusion attacks, information security protection needs to be changed from simple password defense to a dynamic security system covering the entire life cycle, and keystroke dynamics verification has shown unique advantages. This technology analyzes the micro-behavior characteristics of user typing to build individual behavior characteristics, and converts identity authentication from "discrete single check" to "continuous process monitoring". For example, when the system detects abnormal keystroke rhythm, it can automatically trigger secondary authentication or freeze operation to prevent data from being tampered with in time. This continuous invisible protection fills the gap of one-time verification.

[0005] The applicability of keystroke dynamics in desktop scenarios is particularly prominent. First, desktops are usually equipped with physical keyboards, providing hardware support for keystroke data collection. Compared with virtual keyboards on mobile devices, the key travel and feedback mechanism of physical keyboards can generate more stable and distinguishable behavioral characteristics. Second, desktops are often used to handle high-sensitivity tasks, and users often need to operate continuously for a long time. The traditional "login and trust" mode is vulnerable to attackers. Keystroke verification can seamlessly integrate into the workflow and complete continuous identity confirmation without user awareness, achieving "zero-disturbance" continuous authentication and significantly reducing the interruption rate.

[0006] In the current situation of remote work and cross-border collaboration, the scenario value of keystroke dynamics verification is further highlighted. For example, when a user remotely accesses a server through the SSH protocol, the traditional VPN plus password verification method has two problems: first, VPN credential leakage may expose the entire internal network; second, long-term sessions after a legal login lack dynamic protection. By introducing keystroke verification, the system can continuously analyze the user's command line operation habits while they are entering commands, and can automatically terminate the session or alert the administrator if an abnormal pattern is detected. This real-time protection mechanism is more suitable for high-risk remote operating environments than the traditional periodic password change strategy.

[0007] Almost all operating terminals are equipped with input devices such as keyboards, and using the use characteristics of these devices for identity recognition not only inherits the convenience and security of biometric authentication, but also overcomes the problems of strong device dependency, high privacy concerns, and high costs. More importantly, keystroke behavior authentication supports continuous authentication, i.e., the user is continuously authenticated during operation of the terminal, significantly improving the ability to prevent counterfeiting and impersonation. In summary, identity verification technology based on keystroke behavior has unique advantages and broad application prospects.

[0008] Existing research on continuous identity verification based on keystroke behavior characteristics has focused on one-time authentication of fixed text (such as login passwords) in the early stage, which performs well in this scenario but degrades in free text. Existing research focuses on the processing of time features and focuses on algorithm selection and improvement, but these existing solutions still have the following two problems, which limit their practical application: existing models such as distance metric-based matching algorithms, convolutional neural networks, recurrent neural networks, twin neural networks, chaotic neural networks, and long short-term memory networks cannot effectively extract the keystroke association between features and data, thus extracting keystroke rhythm; although existing research has processed time features, the number of considered features is still too small, which can easily lead to overfitting and insufficient generalization. SUMMARY

[0009] When the existing model is applied to the actual test of free text, only relying on the key code and time information, the number of features is insufficient, which is easy to cause overfitting and affect the generalization performance. The additional features collected by external devices (such as microphones, cameras, and wristwatches) do not meet the actual use conditions in the defense system. Although the semantic information of the text can improve the recognition ability, in the system command and working scene, the semantic information input by the user is overlapped and cannot be effectively distinguished, so the effect is limited. Therefore, this paper starts from the keyboard itself, excavates its inherent information, and realizes feature expansion and behavior data enhancement.

[0010] In the prior art, there are certain deficiencies in the user keystroke data in the neural network model feature extraction, and the internal correlation information of the data is not fully captured, which makes it difficult for the model to accurately capture the unique keystroke rhythm of each user. The present application proposes a feature attention and rhythm attention for multi-scale feature extraction, which adaptively focuses on key features, thereby better extracting the personalized rhythm information of the user and improving the sensitivity of the model to subtle differences.

[0011] In view of the problem that the existing features in the prior art are easy to cause the model to overfit, thereby affecting the generalization performance, the present application proposes a keyboard position function encoding for feature expansion, which enhances the behavior pattern of the user keystroke data and further enriches the input data of the model, thereby improving the generalization ability of the model.

[0012] In view of the problem that the use of the prior art is affected by various factors, which not only affects the performance stability of the system, but also increases the error rate in the verification process, the present application proposes a multi-sliding sequence method and a continuous verification algorithm, which can effectively improve the adaptability and accuracy of the system in a dynamic environment and enhance the robustness.

[0013] Further limited, the continuous identity verification method based on keystroke behavior features includes the following specific steps:

[0014] Step 1: The user needs to log in to the system in advance to collect keystroke data, and the system captures the timestamp of the key press through the listening keyboard keystroke event to obtain the basic keystroke data;

[0015] Step 2: The basic keystroke data is vectorized, the press and release events are paired to form complete single key events, and various time intervals between adjacent keys are calculated to obtain keystroke vector data. The keystroke vector data is spliced in the time step according to the time stamp of the original press in the order to form complete single key input sequence data;

[0016] Step 3: The single key input sequence data is expanded by keyboard function position coding;

[0017] According to the data of each user, the keyboard position function coding is performed, which includes the following multiple fields:

[0018] 1) Position identification: indicating whether the key has fixed horizontal and vertical coordinates;

[0019] 2) Frequency of use identification: according to the frequency and importance of the key in input, the level is divided, reflecting the user's proficiency;

[0020] 3) Vertical position: marking the row where the key is located, starting from the bottom space row and increasing sequentially;

[0021] 4) Horizontal position: the left and right edges respectively describe the horizontal coordinates of the key with numerical values;

[0022] 5) Left and right hand area division: classifying the keys to distinguish between left and right hand use;

[0023] 6) Word break end identification: marking the key as a word break;

[0024] 7) Function area marker: function classification of the keys.

[0025] Step four, divide the keystroke data into three sequence length input data by the multi-sliding sequence method, and input them into the neural network model respectively;

[0026] The multi-sliding sequence method includes the following three sequences:

[0027] Sequence 1: Divide the single key input sequence data into data groups of fixed length L.

[0028] Sequence 2: According to the content input by the user, the single key input sequence data is extracted into a word sequence by a simplified adaptive word segmentation method; the adaptive word segmentation method consists of the following three rules:

[0029] 1) Breakpoint identification: when the input key has the word break end identification in the keyboard position function code, it is automatically separated.

[0030] 2) Interval time: if the time interval between two keys is too long, the system automatically identifies it as a separation point and performs word segmentation processing.

[0031] 3) Sequence length: when the length of sequence 2, i.e. the number of keystroke vectors in sequence 2, exceeds the fixed length of sequence 1, the system will automatically divide it into independent sub-sequences.

[0032] Sequence 3: Divide the single key input sequence data into single data groups represented by three key combinations.

[0033] Step five, the neural network model is trained based on the input data to obtain a user-specific model, and the structure of the neural network model is as follows: first, the mean and standard deviation of the user are used to standardize all input data, then the feature attention module and the rhythm attention module are used, then the multi-layer full connection and Dropout are used, and finally the input data obtained is subjected to an activation function to obtain the model output probability.

[0034] The specific steps of feature attention are as follows: first, the input data X is received, and for each pair of adjacent key stroke sequence vectors x t、 x t+1 is spliced to form a new feature vector z t ; then the feature vector z t is projected through full connection to generate a query vector Q t , and the dimension is reduced; then the feature vector z t is multiplied by the learnable weight matrix W k and W v respectively to generate key vector K t and value vector V t ; then the dot product of the query vector Q t and the transposed key vector K t is calculated to obtain the general attention weight A t , which is normalized by Softmax; then the attention weight A t is multiplied by the transposed value vector V t to generate a new feature vector h t ; finally, the feature vectors h t of each time step are stacked to form a new output sequence H.

[0035] The specific steps of rhythm attention are as follows: first, the input data X is received, and the position encoding function PE is added in the time dimension to obtain the input feature matrix X input ; then for each sequence of the input feature matrix X input , full connection is used to map it to a lower-dimensional space for dimension reduction compression to obtain a high-dimensional feature symbol representation X dense ; for character-level features, X input is used as the input matrix X char , and for word-level and phrase-level features, different convolution kernel sizes are used for one-dimensional convolution to extract features, obtaining two levels of input matrices X word , X phrase ; then the obtained matrices are multiplied by the learnable weight matrices W Q , W K , W V to generate Q vectors, K vectors and V vectors, and the attention weight is calculated to obtain an attention output score matrix A l; the obtained attention output score matrix A l The output is obtained by multiplying the V vector, and the feature distribution is standardized by layer normalization; finally, the attention outputs of the three levels of characters, words, and phrases are spliced to obtain the final calculation matrix.

[0036] Step six, enter the identity verification phase, and perform data processing operations according to the keystroke data collection phase, including event collection, data vectorization, feature expansion, and then use the exclusive model to obtain the model output probability through matrix calculation;

[0037] Step seven, use the continuous verification algorithm to process the model output probability to obtain the final identity verification probability.

[0038] The continuous verification algorithm includes the following three mechanisms:

[0039] 1) Dynamic weighting mechanism: after each keystroke operation, the neural network model outputs a recognition probability p w (w is the current time step window), only the probability sequence {p w-W+1 ,…,p w} of the last W keystrokes is retained, and an exponential decay weight w t is added to the recognition probability of each time point, which decays over time; At the same time, a fault-tolerant mechanism for removing outliers is introduced: among the W keystroke probabilities, n maximum and minimum values (i.e. outliers) are removed, and the weighted average probability

[0040] 2) Dynamic fluctuation mechanism: within a certain period of time, if the recognition probability fluctuates more than a certain threshold, it may indicate that the identity has changed; The following weighted fluctuation value can be used to detect short-term fluctuations in the probability sequence within the window W, if it exceeds the set threshold, it means that the verification probability fluctuates sharply, and there may be an abnormal situation, which can trigger an "identity suspicious" flag, which can be logged and require further multi-round authentication;

[0041] Attack mode recognition: based on fluctuation detection, set a low probability alert line P min , if more than half of the probabilities p i in the window W are less than P min , immediately trigger the system's "suspicious behavior" flag, which can be logged and require further multi-round authentication, which can quickly identify the situation where a disguised intruder inputs a destructive command, because their keystroke features are significantly different from the original user, and the recognition probability will drop rapidly;

[0042] 3) Confidence evaluation mechanism:

[0043] a. Mean and standard deviation of the latest recognition probability: use the sliding window W data to dynamically calculate the confidence θt ;

[0044] b. Minimum confidence level requirement: Ensure confidence level θ t Not lower than the minimum confidence level requirement θ set by the system min ;

[0045] The system adaptively adjusts based on the authentication results within the sliding window; when the system's confidence level θ for the user... t When θ is high min It can be appropriately reduced, allowing for some fluctuation; when the confidence level θ t When θ is low min This can be improved, thereby increasing the rigor of the system.

[0046] The advantages of this invention are:

[0047] 1) This invention designs a neural network model structure based on feature attention and rhythm attention. The proposed feature attention can capture the rhythmic correlation hidden in the keystroke sequence, enabling the model to focus on key features and reduce dependence on irrelevant and noisy information, thereby improving the ability to extract complex and unstable user behavior features; the proposed rhythm attention can effectively mine the operating habits in intermittent keystroke data, further improving the verification accuracy.

[0048] 2) This invention innovatively proposes keyboard position function encoding, which enables feature expansion, gets rid of excessive dependence on a small number of features, reduces the risk of overfitting, and enhances the model's generalization ability.

[0049] 3) This invention also proposes a multi-sliding sequence method, which uses a fixed-length sequence 1 for collaborative verification, an adaptive extraction of short text information from sequence 2, and a three-key combination of sequence 3 to quickly capture changing trends and refine the processing of different behavior types.

[0050] 4) This invention proposes a continuous verification algorithm. By introducing time weighting, dynamic fluctuation, and confidence assessment mechanisms, the false rejection rate is reduced, further enhancing the robustness of the system and ensuring efficient and accurate continuous identity verification. Attached Figure Description

[0051] Figure 1 A graph showing the basic keystroke data;

[0052] Figure 2 This is a diagram of the single-key input sequence data of the present invention;

[0053] Figure 3 This is a heatmap of keystroke data statistics for the present invention;

[0054] Figure 4 This is a diagram of the multi-sliding sequence method of the present invention;

[0055] Figure 5 A neural network model structure diagram of the present application;

[0056] Figure 6 A feature attention structure diagram of the present application;

[0057] Figure 7 A rhythm attention structure diagram of the present application. DETAILED DESCRIPTION

[0058] In order to facilitate those skilled in the art to understand and implement the present application, the present application will be further described in detail below in combination with the drawings and examples. Obviously, the described examples are only partial examples of the present application, but not all examples, and all other examples obtained by those skilled in the art without creative labor on the basis of the examples in the present application shall belong to the protection scope of the present application.

[0059] The present application proposes a continuous identity verification method based on keystroke behavior characteristics, and the specific steps are as follows:

[0060] Step one, the system collects user keystroke data, and the system captures the timestamp of the key press through the keyboard strike event to obtain the basic keystroke data, as shown in Figure 1 , "KeyPress" is the key press event, "KeyRelease" is the key release event, and each event has a corresponding timestamp.

[0061] Step two, the basic keystroke data is vectorized, the press and release events are paired to form complete single key events, and the time intervals between adjacent keys are calculated to obtain keystroke vector data, as shown in Figure 1 , that is, "P" is the timestamp of the key press time, "R" is the timestamp of the key release time, "H" represents the holding time between the press and release of the same key, "P[1]P[2]" represents the interval time between the press of the first key and the press of the second key, "R[1]P[2]" represents the interval time between the release of the first key and the press of the second key, "P[1]R[2]" represents the interval time between the press of the first key and the release of the second key, and "R[1]R[2]" represents the interval time between the release of the first key and the release of the second key. As shown in Figure 2 , individual keystroke vector data is spliced in time steps according to the original press timestamp sequence to form complete single key input sequence data.

[0062] Step three, the single key input sequence data is expanded by keyboard function position coding.

[0063] This study selects ANSI standard keyboard layout, and counts the frequency of each key in the main function area of the data set, as shown in Figure 3The keyboard position function code is encoded according to the data of each user, indicating the different meanings of each key in the actual use of the model of each user. Many keys, especially word combinations, will form muscle memory and will be completed in a coherent manner in the form of words or even sentences. The higher the frequency, the more skilled the keystroke error will be smaller, and the higher the confidence of the judgment.

[0064] The coding structure comprehensively describes the key attributes through multiple fields:

[0065] 1) Position identification: indicates whether the key has fixed horizontal and vertical coordinates ("1" for fixed, "0" for not fixed).

[0066] 2) Frequency of use identification: divided into five levels according to the frequency and importance of the key in input, reflecting the user's proficiency. For example, "4" represents frequently used high-frequency keys (such as letters, enter, space); "3" represents navigation keys, shortcut keys and frequently used symbols; "2" represents other function symbols; "1" corresponds to the small keyboard number; "0" represents not used.

[0067] 3) Vertical position: the value from 0 to 4 marks the row where the key is located, and the value increases sequentially from the bottom space row.

[0068] 4) Horizontal position: the left and right edges are described with values from 0 to 270 to ensure the consistency of key width and spacing.

[0069] 5) Left and right hand area division: classify the keys and distinguish between left and right hand use (for example, "1" for left hand area, "2" for right hand area, "3" for space, "0" for none).

[0070] 6) Word and sentence breakpoint end identification: marks the keys that serve as word segmentation breakpoints (such as semicolon, comma, period, question mark, Enter, space, Esc, represented by "1", otherwise "0").

[0071] 7) Function area marker: function classification of keys, such as "5" for letter area, "4" for shortcut combination key, "3" for symbol key, "2" for single key function key, "1" for number key, "0" for none.

[0072] Step four, divide the keystroke data into three sequence length input data through the multi-sliding sequence method, and input them into the neural network model.

[0073] In the prior art, the verification result needs to pass a sequence length to give out, but in the extreme attack scene or in the enterprise operation scene, the attacker may only operate a short sequence, resulting in that there are still most of the legal verifier data in the verification data, so that the model is misjudged as legal. Therefore, the present application proposes a multi-sliding sequence method, for example, a user inputs the word "continuous identity verification" through a keyboard, obtains a string of keystroke data, and the corresponding sequence contents are as shown in Figure 4

[0074] Sequence 1: the single-key input sequence data is divided into data groups with a fixed length L.

[0075] Sequence 2: according to the content input by the user, the single-key input sequence data is extracted by a simplified adaptive word segmentation method to obtain a word or pinyin sequence; the adaptive word segmentation method is composed of the following three rules:

[0076] 1) Breakpoint identification: when the input key has a word / sentence breakpoint end identifier in the keyboard position function code, automatic separation is performed.

[0077] 2) Interval time: if the time interval between two keys is too long, the system automatically identifies it as a separation point and performs word segmentation processing.

[0078] 3) Sequence length: when the sequence 2 length, i.e., the number of keystroke vectors in sequence 2, exceeds the fixed length of sequence 1, the system will automatically divide it into independent sub-sequences.

[0079] Sequence 3: the single-key input sequence data is divided into single data groups represented by three-key combinations.

[0080] The present method combines multiple sequences (fixed length, word sequence, three-key combination) and inputs them into a neural network model for parallel collaborative verification, so that it can adapt to different keystroke behaviors and quickly respond when facing attacks or alternative operations to detect abnormal situations.

[0081] Step five: input the user keystroke data into the neural network model for model training to obtain a user-specific model, and the neural network model structure is as shown in Figure 5 : first, use the mean and standard deviation of the user to standardize all input data, then pass through the feature attention module and the rhythm attention module, then pass through multiple layers of full connection and Dropout, and finally obtain the output data through the activation function to obtain the model output probability.

[0082] ​The personal keystroke rhythm is a continuous process, and the keystroke target is to complete the combination of letters to form words with semantic information, so the most relevant keystroke is its adjacent keystroke in time, and the position of the key will affect the holding time of each keystroke and the interval time between two keystrokes. The prior art uses CNN for feature extraction, but the receptive field range of CNN is limited, which can only highlight and strengthen some features, and it is difficult to represent the relationship between complex features and the degree of association between features. Therefore, a feature attention is designed in this paper to capture the feature relationship combination between a key and its adjacent keys, and also to fully excavate the potential details association and time dynamic weight in the keystroke data, and enhance the model's ability to capture adjacent sequence features. The specific structure of the feature attention is as shown in Figure 6 The specific steps are as follows:

[0083] First, receive the input data X ∈ R B×T×F , where R represents the data matrix, B represents the batch size, T represents the input sequence length, and F represents the feature dimension. For each pair of adjacent keystroke sequence vectors x t、 x t+1 , concatenate them to form a new feature vector z t :

[0084] z t = Concat(x t ,x t+1 )

[0085] Then project the feature vector z t through full connection to generate the query vector Q t . The feature is fully mapped while being reduced in dimension, and the common redundant features between sequences are eliminated while the relationship between features is strengthened, where W q represents the weight, b q represents the bias term, R represents the data matrix, F represents the feature dimension, and t represents each time step:

[0086] Q t = W q z t +b q , Q t ∈ R F

[0087] Then multiply the feature vector z t by the learnable weight matrix W k and W v to generate the key vector K t and the value vector V t , where R represents the data matrix, F represents the feature dimension, and t represents each time step:

[0088] Kt = z t W k , K t ∈ R 1×2F

[0089] V t = z t W v , V t ∈ R 1×2F

[0090] Recalculating the dot product of the query vector Q t and the transposed key vector to obtain the general attention weight A t , normalized by Softmax, where R represents the data matrix, F represents the feature dimension, and T represents the transpose of the matrix:

[0091]

[0092] Then multiply the attention weight A t and the transposed value vector to generate a new feature vector h t , where R represents the data matrix, F represents the feature dimension, and T represents the transpose of the matrix:

[0093]

[0094] Finally, stack the feature vectors h t at each time step to form a new output sequence H, where R is the data matrix, B is the batch size, T represents the input sequence length, F represents the feature dimension, and T represents the transpose of the matrix:

[0095] H = [h1, h2, …, h T-1 ] T , H ∈ R B×(T-1)×F

[0096] The feature attention module generates new time series features by capturing the dynamic relationship between adjacent time step features, thereby enhancing the model's expression ability.

[0097] In the normal input process, the keystroke sequence and the attention between the keystroke sequence and the word sequence are often accompanied by pauses and thinking phenomena, which will lead to the weakening of context relevance, and at the same time, in the presence of abnormal points, the point-based attention mechanism may have an adverse effect on the overall weight. Therefore, the present patent will combine convolution operation to extract keystroke trends in a period of time, so as to capture the overall information at the word level; At the same time, another layer focuses on extracting the relevance between keys and keys, especially in practical applications, by weakening the irrelevant discrete values caused by pause thinking, and strengthening the truly relevant keystroke information. In the feature dimension, attention extraction has been completed, and the current method only needs to perform attention operation in the sequence dimension, thereby effectively reducing the computational complexity.

[0098] Psychological studies show that typical pause points are between words and words, about 6-8 letters in English. In addition to pauses, there are also input errors, and the operation of deleting backspace, so at this time, the misoperation keys are continuous in the physical key position, and the similarity of the keys can be established by using position coding to reduce the influence of learning difference caused by such errors. Establish different receptive fields, which can focus attention mechanism on correct keystroke information when facing different scene tasks, for example, the error rate is low in familiar keystroke scenes, while the error rate may be higher in unfamiliar transcription tasks. The specific structure of rhythm attention is as shown in Figure 7 The specific steps are as follows:

[0099] First, receive input data X, add position encoding function PE in time dimension to get input feature matrix X input The position encoding function can enhance time series information, where t represents each time step, T represents the input sequence length, f represents each feature dimension, and F represents the feature dimension:

[0100]

[0101] X input (t,f)=X(t,f)+PE(t,f),t∈[0,T-1],f∈[0,F-1]

[0102] Then, for each sequence of input feature matrix X input , use full connection to map to a lower dimensional space for dimension reduction compression to get a high dimensional feature symbol representation X dense , where W d represents the weight, b d represents the bias term, t represents each time step, and T represents the input sequence length:

[0103] X dense [t,:]=X[t,:]·W d +b dt∈[0,T-1]

[0104] For character-level features, use X input as the input matrix X char For word-level and phrase-level features, use different convolution kernel sizes to extract features using one-dimensional convolution, resulting in two levels of input matrix X word , X phrase , where l represents different levels of features, k represents the size of the convolution kernel, and s represents the convolution kernel step:

[0105]

[0106] The resulting matrix is multiplied by the learnable weight matrix W Q , W K , W V to generate Q vector, K vector and V vector, and the attention weight is calculated by scaling dot product to get the attention output score matrix A l This step of calculation reduces the time complexity from O(n 2 ) quadratic complexity to linear, where l represents different levels of features, and d represents variance:

[0107]

[0108] The resulting attention output score matrix A l is multiplied by the V vector to get the output O l , and the layer normalization standardizes the feature distribution to get the attention output Z l of different levels, where l represents different levels of features, and LayerNorm represents layer normalization standardization.

[0109] O l =A l ·V l

[0110] Z l =LayerNorm(O l )

[0111] Finally, the character-level, word-level and phrase-level attention outputs are concatenated to get the final calculation matrix X concat , where Concat represents concatenation operation.

[0112] X concat =Concat(Z char ,Z word ,Z phrase )

[0113] Step six, enter the identity verification phase, according to the method of keystroke data acquisition phase, the data processing operation includes event acquisition, data vectorization, feature expansion, and then using the exclusive model to obtain the model output probability through matrix calculation;

[0114] Step seven, using the continuous verification algorithm to process the model output probability, get the final identity verification probability.

[0115] Continuous verification algorithm includes the following three mechanisms:

[0116] 1) Dynamic weighting mechanism: after each keystroke operation, the neural network model will output a recognition probability p w (w is the current time step window), only the probability sequence {p w-W+1 ,…,p w} of the last W keystrokes is retained, and an exponential decay weight t w is added to the recognition probability of each time point, where a is the decay factor (0<α<1), W is the latest time step, and w is the window of each time step. In this way, the recognition probability of the recent time will have a higher weight:

[0117] t w =α W－w

[0118] At the same time, in order to deal with the influence of accidental fluctuations, a fault tolerance mechanism of removing outliers is introduced: among the W keystroke probabilities, n maximum and minimum values (i.e. outliers) are removed respectively, and the weighted average probability

[0119]

[0120] 2) Dynamic fluctuation mechanism: in order to better adapt to the natural fluctuation in identity authentication, a dynamic anomaly detection mechanism is introduced. If the recognition probability fluctuates more than a certain threshold in a certain period of time, it may indicate that the identity has changed. The following weighted fluctuation value is used for short-term fluctuation detection of the probability sequence in the window, where W represents the window size, i represents each window, t represents the exponential decay weight, and p represents the recognition probability:

[0121]

[0122] If it exceeds the set threshold Δσ, it means that the verification probability fluctuates violently, and there may be abnormal situation, which can trigger an "identity suspicion" mark, which can be logged and required for further multi-round authentication.

[0123] Attack mode recognition: on the basis of fluctuation detection, a low probability alarm line P min, e.g. 0.3, if there is more than half probability p i <P min , immediately trigger the system's "suspicious behavior" flag, log the event, and require further multi-round authentication.

[0124] This can quickly identify the situation where a disguised intruder inputs a destructive command, as their keystroke features differ greatly from the original user, and the recognition probability will quickly decrease.

[0125] 3) Confidence evaluation mechanism: To balance real-time performance and fault tolerance, and avoid the system mistakenly rejecting users or over-trusting users in certain situations, a dynamic threshold can be designed, and a confidence θ t is dynamically calculated for each window

[0126] a. Mean and standard deviation of the recent recognition probability: Using the data in the sliding window W, the confidence θ t is dynamically calculated , where is the weighted average in the window, and k is a control parameter (e.g. k = 3):

[0127]

[0128] b. Minimum confidence requirement: Ensure that the confidence θ t is not lower than the system's minimum confidence requirement θ min .

[0129] Adaptive adjustment based on authentication results in the sliding window: When the system's confidence θ t in the user is high, θ min can be appropriately reduced to allow some fluctuations; when the confidence θ t is low, θ min can be increased to increase the system's strictness.

[0130] This continuous verification algorithm combines multiple factors to build a dynamically adjustable verification algorithm, not only considering the immediate features of keystroke data, but also adapting to changes in time and the dynamic nature of user behavior. It can meet different application scenarios, reducing false positives in long-term detection of a single user, and also providing early warning in sudden situations when the identity is changed, balancing real-time performance and fault tolerance.

[0131] Experimental setup:

[0132] This experiment uses Python as the programming language for deep learning models and data preprocessing, and uses the deep learning framework Keras as the tool for model construction and part of the data preprocessing operations.

[0133] To ensure the reproducibility and stability of experimental results, a fixed random seed is set, and the keystroke sequence data is divided into training, validation and test sets in the ratio of 7:1:2. In terms of model initialization settings, the initial learning rate is set to 0.1 (decreasing strategy), the AdamW optimizer with L2 regularization is used, the binary cross-entropy loss is used, and the early stopping callback function is adopted. All experiments. Each model is trained 3 times to average the validation results to reduce the accidental influence. The recognition probability is judged on the test set with a threshold of 0.5, the sequence length is set to 30, and the EER is calculated. The present application compares various methods (see Tables 1 and 2) on the Buffalo and Clarkson II datasets: SVM, Gunetti & Picardi distance metric, KDE, CNN+RNN, TypeNet, CKDAN, and TKCA method only on Clarkson II dataset.

[0134] The results are as follows:

[0135] The TypeNet method performs the worst on the two datasets. The LSTM model and ternary loss function used by the TypeNet method fail to effectively capture the complexity of keystroke behavior, resulting in poor performance.

[0136] The limitations of the SVM method are that it cannot effectively represent all possible keystroke combination behavior features, and its performance on the two datasets is relatively poor.

[0137] The Gunetti & Picardi method is more effective in the case of fixed text with more concentrated features, but it performs poorly in free text because the keystroke changes are greater.

[0138] The KDE method has weak applicability and poor performance.

[0139] The TKCA method considers the diversity of inputs in an unconstrained environment, but its performance is poor because of its weak ability to express behavior features.

[0140] CNN+RNN has deficiencies in extracting adjacent feature associations and is difficult to identify the relevance between distant keystrokes in long sequence keystroke data, affecting the accuracy of rhythm recognition.

[0141] CKDAN is the current best research by introducing a large language model to analyze the input information within the sequence.

[0142] In contrast, the model proposed by the present application captures the relevance between keystrokes by introducing rhythm attention and feature attention, separates words and phrases at the text level, and combines keyboard coding for feature expansion. The results of multiple algorithm parallel computing are fully mined through multi-level learning to make the model performance exceed all existing methods and reach the current optimal level, with EER of 1.58% and 4.23% on the Buffalo and Clarkson II data sets, respectively.

[0143] Table 1 Comparison of existing studies (Buffalo data set)

[0144]

[0145] Table 2 Comparison of existing studies (Clarkson II data set)

[0146]

Claims

1. A keystroke duration identity verification method based on keyboard location function encoding and attention, characterized in that, The specific steps are as follows: Step one, the user needs to log in the system in advance to collect keystroke data, the system captures the timestamp of the key press through listening to the keyboard tapping event to obtain the basic keystroke data; Step two, the basic keystroke data is vectorized, the press and release events are paired to form a complete single key event, and then the time intervals between adjacent keys are calculated to obtain keystroke vector data. The keystroke vector data is spliced in time steps according to the original pressing timestamp sequence to form a complete single key input sequence data; Step three, the single key input sequence data is expanded by keyboard function position coding; According to the data of each user, the keyboard position function coding contains the following fields: 1) Position identification: indicates whether the key has fixed horizontal and vertical coordinates; 2) Frequency identification: according to the frequency and importance of the key in input, the level is divided, reflecting the user's proficiency; 3) Vertical position: marks the row of the key, starting from the bottom space row and increasing sequentially; 4) Horizontal position: the left and right edges are described by numerical values to represent the horizontal coordinates of the key; 5) Left and right hand area division: classifies the keys to distinguish between left and right hand use; 6) Word and sentence breakpoint end identification: marks the keys as word segmentation breakpoints; 7) Function area marker: classifies the keys by function. Step four, the keystroke data is divided into three sequence length input data by the multi-sliding sequence method, which is input into the neural network model. The multi-sliding sequence method includes the following three sequences: Sequence 1: The single key input sequence data is divided into fixed length L data groups. Sequence 2: According to the user's input content, the single key input sequence data is extracted into word sequences by an adaptive word segmentation method. Sequence 3: The single key input sequence data is divided into single data groups represented by three key combinations. Step five, the neural network model is trained based on the input data to obtain a user-specific model. The structure of the neural network model is as follows: first, use the mean and standard deviation of the user to standardize all input data, then pass through the feature attention module and rhythm attention module, then pass through multiple layers of full connection and Dropout, and finally pass through the activation function to obtain the model output probability. Step six, enter the identity verification stage, perform data processing operations according to the keystroke data collection stage, including event collection, data vectorization, and feature expansion. Then use the exclusive model to calculate the model output probability through matrix calculation; Step seven, use the continuous verification algorithm to process the model output probability to obtain the final identity verification probability. The continuous verification algorithm includes the following three mechanisms: 1) Dynamic weighting mechanism: after each keystroke operation, the neural network model will output a recognition probability p w (w is the current time step window), only the probability sequence {p w-W+1 ,…,p w} of the last W keystrokes is retained, and an exponential decay weight w t is added to the recognition probability of each time point, which decays over time; At the same time, a fault-tolerant mechanism for removing outliers is introduced: among the W keystroke probabilities, n maximum and minimum values (i.e. outliers) are removed respectively, and the weighted average probability 2) Dynamic fluctuation mechanism: within a certain period of time, if the recognition probability fluctuates beyond a certain threshold, it may indicate that the identity has changed; the following weighted fluctuation value can be used to detect short-term fluctuations in the probability sequence within the window W. If it exceeds the set threshold, it means that the verification probability fluctuates sharply, which may indicate an abnormal situation, and a "suspected identity" flag can be triggered for further multi-round authentication; Attack pattern recognition: on top of volatility detection, set a low probability alert line P min If more than half of the probabilities p i <P min Immediately trigger the system's "suspicious behavior" flag, log it, and require further multi-round authentication, which can quickly identify situations where a disguised intruder enters a destructive command, as their keystroke characteristics differ greatly from the original user, and the probability of recognition will quickly decrease; 3) Confidence evaluation mechanism: a. Mean and standard deviation of the recent recognition probability: dynamically calculate the confidence level θ using the data of the sliding window W t ; b. Minimum confidence requirement: ensure confidence θ t not less than the minimum confidence requirement θ set by the system min ; Adaptive adjustment based on the authentication results within the sliding window; When the system's confidence in the user θ t is high, θ min may be reduced appropriately, allowing for some fluctuation; when the confidence θ t is low, θ min may be increased, thereby increasing the system's stringency.

2. The keystroke duration identity verification method based on keyboard location function encoding and attention of claim 1, wherein, In step three, the keyboard function position coding method is as follows: According to the data of each user, the keyboard position function coding is performed, including the following multiple fields: 1) Position identification: indicates whether the key has fixed horizontal and vertical coordinates; 2) Frequency identification: according to the frequency and importance of the key in input, the level is divided, reflecting the user's proficiency; 3) Vertical position: marks the row where the key is located, starting from the bottom space row and increasing sequentially; 4) Horizontal position: the left and right edges are described with numerical values to represent the horizontal coordinates of the key; 5) Left and right hand area division: classifies the keys to distinguish between left and right hand use; 6) Word and sentence breakpoint end identification: marks the keys as word segmentation breakpoints; 7) Function area marker: classifies the keys by function.

3. The keystroke duration identity verification method based on keyboard location function encoding and attention of claim 1, wherein, In step four, the multi-sliding sequence method has the following specific steps: Step one, divide the single key input sequence data into data groups of fixed length L to generate sequence 1; Step two, according to the user's input content, extract the word sequence by a simplified adaptive word segmentation method, and divide the single key input sequence data into sequence 2; the adaptive word segmentation method consists of the following three rules: 1) Breakpoint identification: when the input key has the word and sentence breakpoint end identification in the keyboard position function coding, automatic separation is performed; 2) Interval time: if the time interval between two keys is too long, the system automatically identifies it as a separation point for word segmentation processing; 3) Sequence length: when the length of sequence 2, i.e. the number of keystroke vectors in sequence 2, exceeds the fixed length of sequence 1, the system will automatically divide it into independent sub-sequences; Step three, divide the single key input sequence data into single data groups represented by three key combinations to generate sequence 3.

4. The keystroke duration identity verification method based on keyboard location function encoding and attention of claim 1, wherein, In step five, the neural network model processing steps are as follows: Step one, use the mean and standard deviation of this user to standardize all input data; Step two, input the input data processed by the standardization operation into the feature attention module; Step three, input the input data processed by the feature attention module into the rhythm attention module; Step four, input the input data processed by the rhythm attention module into multiple layers of full connection and Dropout; Step six, the final input data is input into the activation function to obtain the model output probability.

5. The feature attention module of claim 4, which has the following specific steps: Step one, receive input data X, for each pair of adjacent keystroke sequence vectors x t、 x t+1 Perform concatenation to form a new feature vector z t ; Step two, project the feature vector z t to generate the query vector Q t , reduce dimensionality; Step three, the feature vector z t is multiplied by a learnable weight matrix w v and w k , respectively, to generate the key vector K t and the value vector V t ; Step four, compute query vector Q t and the transpose of the key vector K t dot product to get the general attention weight A t normalized by Softmax; Step five, attention weights A t are multiplied with the transposed value vector V t to generate a new feature vector h t ; Step six, the feature vector h t The stack forms a new output sequence H.

6. The rhythm attention module of claim 4, which has the following specific steps: Step one, receive input data X, add position encoding function PE in time dimension to get input feature matrix X input ; Step two, dimensionality reduction compression is performed using fully connected mapping to a lower dimensional space for each sequence of input feature matrix X input , resulting in a high-dimensional feature symbol representation X dense ; Step three, for character-level features, use X input as the input matrix X char For word-level and phrase-level features, use different convolution kernel sizes to extract features using one-dimensional convolution to obtain two levels of input matrix X word , X phrase ; Step four, the resulting matrix is multiplied by a learnable weight matrix W Q , W K , W V , generating Q vectors, K vectors and V vectors, attention weights are calculated by scaled dot-product to get an attention output score matrix A l ; Step five, the final attention output score matrix A is obtained l Multiplying with the V vector to obtain the output O l The feature distribution is standardized by layer normalization; Step six, the attention outputs of the three levels of character, word and phrase are spliced to obtain the final calculation matrix X concat .

7. The keystroke duration identity verification method based on keyboard location function encoding and attention of claim 1, wherein, In step seven, the continuous verification algorithm has the following specific steps: Step one, introduce dynamic weighting mechanism: after each keystroke operation, the neural network model will output a recognition probability p w (w is the current time step window), only keep the probability sequence {p w-W+1 ,…,p w} of the last W keystrokes, and add an exponential decay weight w t to the recognition probability of each time point, which decays over time; At the same time, introduce a fault-tolerant mechanism to eliminate outliers: among the W keystroke probabilities, respectively eliminate n maximum and minimum values (i.e. outliers), and calculate the weighted average probability Step two, introduce a dynamic fluctuation mechanism: if the recognition probability fluctuates beyond a certain threshold within a certain period of time, it may indicate that the identity has changed; the following weighted fluctuation value can be used to detect short-term fluctuations in the probability sequence within the window W, if it exceeds the set threshold, it means that the verification probability fluctuates sharply, which may indicate an abnormal situation, and a "suspected identity" marker can be triggered for further multi-round authentication; Attack pattern recognition: on top of volatility detection, set a low probability alert line P min If more than half of the probabilities p i <P min Immediately trigger the system's "suspicious behavior" flag, log it, and require further multi-round authentication, which can quickly identify situations where a disguised intruder enters a destructive command, as their keystroke characteristics differ greatly from the original user, and the probability of recognition will quickly decrease; Step three, introduce a confidence evaluation mechanism: a. Mean and standard deviation of the recent recognition probability: dynamically adjust the confidence level θ using data in the sliding window W t ; b. Minimum confidence requirement: ensure confidence θ t not less than the minimum confidence requirement θ set by the system min ; Adaptively adjust based on the authentication results within the sliding window; When the system's confidence in the user θ t is high, θ min may be reduced appropriately, allowing for some fluctuation; when the confidence θ t is low, θ min may be increased, thereby increasing the system's stringency.

Images