Lightweight low-delay continuous authentication method and system based on linear attention hybrid network

Abstract

The invention relates to a lightweight low-delay continuous authentication method and system based on a linear attention hybrid network, and belongs to the technical field of information. The method specifically comprises the following steps: S1, a registration stage: collecting behavior data of a legal user and preprocessing the behavior data; training a lightweight hybrid feature extraction model, and establishing and storing a user behavior contour; s2, an authentication stage: collecting user behavior data in real time and preprocessing the user behavior data, extracting behavior characteristics and matching the behavior characteristics with stored behavior contours, and executing access control operation according to a matching result. According to the method, a global attention mechanism and a space-time attention mechanism are introduced, the long-term dependency relationship in a behavior biological feature sequence is fully captured, and the robustness of the model to noise and abnormal values is enhanced; through effective fusion of multi-sensor data and global features of different time points, high-precision legality verification of a user identity in a small authentication window is finally realized.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of information technology and relates to a lightweight low-latency continuous authentication method and system based on a linear attention hybrid network. BACKGROUND

[0002] In recent years, mobile device authentication systems have received extensive attention. This research aims to ensure that the private and sensitive information of users in mobile devices is protected. Authentication systems are critical to strengthening security measures for mobile devices to prevent unauthorized access. However, today's mobile devices are vulnerable to various forms of unauthorized access or theft, making mobile device authentication systems a challenging task.

[0003] In today's digital age, identity verification mechanisms are crucial for protecting user privacy and sensitive information. To prevent information leakage, a reliable authentication mechanism must be implemented to ensure the security of mobile devices. Common authentication mechanisms include using pin, graphical password, Face id, and fingerprint to unlock mobile devices. These one-time authentications, as a traditional authentication method, provide some security assurance, but as technology evolves and security threats evolve, the crisis it faces is increasingly prominent. There have been many targeted attack methods, such as smudge attacks, shoulder surfing attacks, and password inference attacks, which allow attackers to obtain users' one-time authentication information, making it easy for them to impersonate legitimate users and perform unauthorized operations.

[0004] To effectively address these challenges, continuous authentication mechanisms have received extensive attention. Continuous authentication is a dynamic authentication method that monitors and verifies users in real time throughout the session. Unlike traditional one-time authentication, continuous authentication not only relies on the initial authentication step, but also monitors user behavior patterns, biometric features, device status, and other factors to ensure that users remain legitimate throughout the session. Continuous authentication systems can continuously monitor user activity and behavior patterns, and when users do not actively use the system or when abnormal user behavior data is detected, the system session will automatically lock. In recent years, many behavior-based continuous authentication methods have been extensively studied, such as walking gait, touch gestures, electrocardiogram, keystroke dynamics, speech, and signature.

[0005] Currently, continuous authentication methods are basically using various built-in sensors in mobile devices to conduct behavioral biometric recognition. The sensor-based continuous authentication system integrates various sensors from mobile devices, such as accelerometers, gyroscopes, magnetometers, gravity sensors, direction sensors, and tactile sensors. Considering the authentication time and accuracy, the selection of accelerometers, gyroscopes, and magnetometers is one of the best choices for continuous authentication. Through continuous authentication based on these three types of sensors, access is granted to legitimate users at entry points and throughout the use session, significantly improving the reliability and security of authentication. At the same time, this authentication method is an implicit identity verification method, resulting in minimal user interruption and maintaining a relatively user-friendly experience. With the expansion of storage and computing resources and the availability of sensors, implicit authentication has become very accurate and effective, and the field of continuous authentication has received increasing attention. The authentication method based on the three types of sensors of accelerometers, gyroscopes, and magnetometers provides convenient and efficient access control for users.

[0006] Currently, due to the large amount of noise in the sensor data collected by smartphones, it is difficult to capture strong features that adapt to various noise patterns. A lot of research has been done to design a continuous authentication system with low latency, low computational cost, and high accuracy.

[0007] Traditional methods are mainly based on manually extracting sensor-based features, including time-domain features such as mean, maximum, and minimum values of single-axis sensor readings, and frequency-domain features such as strength, peak amplitude, and frequency of single-axis sensor readings. However, the method of manually designing features is highly dependent on the field, time-consuming, labor-intensive, and difficult to generalize.

[0008] In recent years, the rapid development of deep learning technology has brought new solutions to the field of image processing. With the development of deep convolutional neural networks (Deep Convolutional Neural Networks), features can be automatically learned from raw data without the need for manual feature design, reducing human intervention and workload, and making the process of continuous authentication tasks more convenient. For systems that do not require manual feature design, one process of many continuous authentication works is: first, collect data from relevant mobile sensors. Next, these data will go through a preprocessing stage to remove noise, standardization, and other operations to improve data quality and consistency. Then, the data is input into the model for feature extraction, which aims to identify useful information for classification tasks from raw data. Finally, the extracted features are analyzed by the classifier to assess the legitimacy of the user.

[0009] However, due to the collected sensor data containing a large amount of noise, the continuous authentication task is extremely challenging to function robustly. Hu et al. proposed a dual-input stream verification system, which takes the frequency domain data and time domain difference data collected by the accelerometer and gyroscope as dual stream input, learns and extracts representative features with high discriminability. Luo designed a CNN specifically for deep feature extraction and used automatic augmentation search to find the optimal CNN training data augmentation strategy. In another work, Luo et al. proposed a continuous authentication system based on CNN, which fully utilizes the data of the accelerometer, gyroscope and magnetometer on the smartphone, and uses conditional Wasserstein generative adversarial network (CWGAN) for data augmentation to improve the generalization ability of the model. However, it is difficult for traditional CNN paradigm models to achieve high accuracy in a small continuous authentication window. To address this challenge, many global attention methods based on the Transformer paradigm have been proposed. In FuMeAuth, the fusion of global-local memory network (FuMe) effectively captures and adaptively combines the shared-private features of sensor data. Ouyang et al. use Transformer GAN to enhance accelerometer, gyroscope and magnetometer data for better training of models in continuous authentication systems. AuthConFormer considers the long-term dependencies between behavioral biometric sequences and uses the Transformer model to solve the problem of poor performance at high authentication frequencies.

[0010] At the same time, for resource-constrained mobile network tasks, traditional CNN and Transformer model paradigms usually require a large number of parameters and floating-point operations to achieve satisfactory accuracy. Liu et al. used Ghost Module, which uses lightweight deep convolution technology to generate more features with fewer parameters, achieving a satisfactory accuracy. In another work, Liu et al. designed a lightweight classifier, designed a memory-enhanced autoencoder trained only on legitimate user data, and the trained encoder reconstructed user data according to the current user's input, then calculated the reconstruction error for classification. At the same time, Yang et al. noticed that the quadratic computational complexity of Transformer is extremely large, and through low-rank decomposition, they made Transformer lightweight, achieving lower parameter quantity, computation and latency.

[0011] The traditional continuous authentication model has significant performance defects in the face of application scenarios with high authentication frequency and small authentication window. On the one hand, due to the small authentication window, the model is difficult to fully capture the long-term dependence relationship contained in the user behavior biological feature sequence, resulting in insufficient feature extraction. On the other hand, such a model is sensitive to noise and outliers in the data, and has insufficient robustness. These problems together cause the authentication accuracy of the traditional model to decrease significantly under high authentication frequency, making it difficult to complete the legality verification with high reliability within strict time constraints.

[0012] In the specific implementation of the model, the attention mechanism (such as the traditional scaled dot-product attention mechanism) as a key component to capture long-term dependencies has a serious computational efficiency problem. Its computational complexity grows quadratically with the sequence length, which brings an excessive computational burden for mobile devices that need to process long sequence data and have limited computing resources. This computational bottleneck greatly limits the deployment and application of high-performance attention models in resource-constrained environments.

[0013] The continuous authentication task targeted by the present application is designed for resource-constrained mobile devices. Traditional models such as convolutional neural networks (CNN) and multi-layer perceptrons (MLP) have complex structures and large numbers of parameters, and direct application to mobile terminals will result in large model size, slow inference speed, and high energy consumption, which cannot meet the stringent requirements of continuous authentication tasks for low latency and low power consumption. Therefore, a lightweight overall network architecture is needed to efficiently deploy the model on mobile terminals while ensuring performance. SUMMARY

[0014] In view of the above, the purpose of the present application is to provide a lightweight low-latency continuous authentication method and system based on a linear attention hybrid network, which fully captures the long-term dependence relationship in the behavior biological feature sequence by introducing global attention mechanisms and spatio-temporal attention mechanisms, and enhances the robustness of the model to noise and outliers. By effectively fusing multi-sensor data and global features at different time points, the network ultimately performs high-precision legality verification on user identity within a small authentication window.

[0015] To achieve the above purpose, the present application provides the following technical solutions: A lightweight low-latency continuous authentication method based on a linear attention hybrid network, which specifically comprises the following steps: S1, registration phase: collect the behavior data of the algorithm user and pre-process; train a lightweight hybrid feature extraction model, establish a user behavior profile and store; S2, authentication phase: real-time collection of user behavior data and pre-processing, extraction of behavior features and matching with stored behavior profile, and execution of access control operation according to matching result.

[0016] Further, step S1 specifically includes: S11, on the mobile device, collect the behavior data generated by the legitimate user through the built-in sensors; S12, preprocess the collected behavior data, including normalization and data segmentation; S13, send the preprocessed data to the server for training the lightweight hybrid feature extraction model; S14, receive the trained model parameters returned from the server, and locally establish and store the behavior profile of the legitimate user on the mobile device.

[0017] Further, step S2 specifically includes: S21, when the user interacts with the mobile device, trigger the system to collect real-time user behavior data; S22, preprocess the real-time collected behavior data in the same way as step S12; S23, input the preprocessed data into the trained lightweight hybrid feature extraction model to extract behavior features; S24, match the extracted behavior features with the legitimate user behavior profile stored locally to determine whether the current user is a legitimate user; S25, if it is determined that the user is legitimate, maintain the session; if it is determined that the user is not legitimate, lock the device.

[0018] Further, the collection of user behavior data includes: Collect six-dimensional vector data (Ax, Ay, Az, Gx, Gy, Gz) from the accelerometer and gyroscope; Use the formula Min-max normalize the data j on each sensor axis i; segment the normalized data into non-overlapping 2-second time windows, each window containing 200 samples at a 100Hz sampling rate.

[0019] Further, the lightweight hybrid feature extraction model described in steps S13 and S23 uses a dual-stream architecture for feature extraction, which includes: capturing fine-grained spatial features through local streams; modeling global temporal features through global streams; Through the global-local interaction module, dynamically fuse the output features of the local stream and the global stream using the cross-attention mechanism; Through the self-attention mechanism, adaptively fuse the accelerometer and gyroscope features, and process them together with the global features via a multi-subspace MLP to generate fusion features that comprehensively represent local and global behavior features.

[0020] Further, the lightweight hybrid feature extraction model aims to efficiently promote the interaction between global information and local information, thereby extracting representative features from sensor data, and the lightweight hybrid network architecture can achieve high-precision classification even in a resource-constrained environment; the model consists of four modules: local flow, global flow, global-local interaction module, and classification head, specifically including: The data of the accelerometer and the gyroscope are input into a double-path architecture: local flow and global flow; the local flow adopts a CNN pyramid structure, including a Stem layer and four local feature extraction blocks LFEB, which process the accelerometer and gyroscope data respectively to learn fine-grained temporal features; the global flow consists of an embedding layer and four GLU-based Transformer blocks GBTB, which use attention mechanisms to capture long-range spatiotemporal dependencies in user behavior patterns; The features of the corresponding layers of the LFEB and the GBTB are cross-attention fused by the global-local interaction module, and the output is transmitted to the subsequent layer to realize mutual optimization of global and local representations; the global and local features are processed by the classification head respectively: the local CNN flow fuses six-axis data through an accelerometer and gyroscope adaptive fusion module AGAF, which adopts a self-attention mechanism; Subsequently, the local features are reshaped and processed by a multi-subspace MLP (MSMLP); at the same time, the global features are also reshaped and processed by the MSMLP; finally, the global and local features are spliced and output the classification result through a fully connected layer.

[0021] The application also provides a lightweight low-delay continuous authentication system based on a linear attention hybrid network, characterized in that the system comprises: a data acquisition and preprocessing module, a lightweight hybrid feature extraction module, and an authentication decision module. The data acquisition and preprocessing module is configured to acquire user behavior data from the built-in sensors of a mobile device in real time, and to perform normalization processing and segmentation on the data. The lightweight hybrid feature extraction module is connected with the data acquisition and preprocessing module and is configured to receive the preprocessed data and extract local fine-grained features and global temporal features of user behavior using the double-flow architecture inside. The authentication decision module is connected with the lightweight hybrid feature extraction module and is configured to match the extracted features with the registered legal user behavior profile to determine whether the current user identity is legal, and to perform corresponding access control operations.

[0022] Further, the data acquisition and preprocessing module is specifically configured to: acquire data from built-in accelerometer and gyroscope sensors; the acquired data is a six-dimensional vector, including linear acceleration (Ax, Ay, Az) of the accelerometer on three axes and angular velocity (Gx, Gy, Gz) of the gyroscope on three axes; use the minimum-maximum normalization method to independently normalize the data on each sensor axis; and divide the normalized data into non-overlapping 2-second time windows, each window containing 200 samples at a sampling rate of 100 Hz.

[0023] Further, the lightweight hybrid feature extraction module is an LHGT module, which includes: a local stream that uses MobileNetV2-based blocks to capture fine-grained spatial features; a global stream that uses GLU-based Transformer blocks with spatio-temporal attention to model broader temporal features; a global-local interaction module that uses a cross-attention mechanism to dynamically facilitate feature exchange between the local stream and the global stream outputs; and a feature fusion and classification head that is configured to first adaptively fuse accelerometer and gyroscope features as local features through a self-attention mechanism, and then process them together with global features through a multi-subspace MLP to generate final fusion features for authentication.

[0024] The present application has the following advantages: In view of the common defects of existing mobile continuous identity authentication schemes, such as "model compression accuracy drops sharply, and robustness decreases when the number of unknown users increases", the present application LHGTAuth achieves 7.06M multiply-add operations without quantization or pruning, and reduces the equal error rate (EER) to 0.09% (10 unknown users) and 0.97% (50 unknown users), respectively; the corresponding authentication accuracy is 99.91% (10 unknown users) and 99.02% (50 unknown users), and the F1-score always remains above 99%, showing outstanding performance in high accuracy and high robustness.

[0025] The unknown user tolerance is greatly improved. As the number of unknown users increases, the EER generally rises linearly, the FAR and FRR rapidly break through 5%, resulting in frequent model retraining during actual deployment. In the extreme scenario where the number of unknown users increases from 10 to 50, the EER increases by less than 1 percentage point, the FAR is always <1.7%, and the FRR is <0.3%, the system still works stably, significantly reducing the background update frequency and maintenance cost.

[0026] Compared with the self-attention O(N 2 ) complexity of the traditional Transformer, the application adopts GLU-based linear space-time attention, and the calculation amount is reduced to O(N); in combination with Multi-Subspace MLP, the parameter amount is reduced from MxN to (MxN) / n. Taking n=4 as an example, the total parameter amount and floating point operation amount of the model are compressed to 1 / 4 of the traditional MLP, the measured reasoning delay of the mobile terminal is reduced by 55%, and the real "lightweight" is realized while maintaining 99%+ accuracy.

[0027] The model is friendly to compression, and the precision loss is minimal. The background technology generally appears 1%-3% accuracy drop after using quantization, pruning and distillation, and needs complex retraining compensation. The scheme has low network redundancy due to the original use of depth separable convolution, SE module and linear GLU, and the EER only rises by 0.08%, which is still lower than 1%.

[0028] Other advantages, objects and features of the application will be set forth in part in the following specification, and in part will become apparent to those skilled in the art from the examination of the following specification, or can be learned from practice of the application. The objects and other advantages of the application can be realized and attained by the below description. BRIEF DESCRIPTION OF DRAWINGS

[0029] In order to make the objects, technical solutions and advantages of the application clearer, the preferred detailed description of the application will be combined with the drawings to describe the application, and the drawings are as follows: Figure 1 The structure diagram of the lightweight low-delay continuous authentication system based on the linear attention hybrid network of the application; Figure 2 The LHGT architecture diagram of the application; Figure 3 The architecture diagram of GLAF; Figure 4 The global-local interaction module; Figure 5 The index change of three models about different invisible users; Figure 6 The seasonal intensity visualization diagram. DETAILED DESCRIPTION

[0030] Following, specific, concrete examples will be described in order to explain the embodiments of the present application in more detail. As will be obvious to those skilled in the art, other advantages and effects of the present application can be readily derived from the description of the present application. The present application can also be carried out or applied by using different specific embodiments, and various modifications or changes can be made to the details of the present application based on different viewpoints and applications without departing from the spirit of the present application. It should be noted that the drawings provided in the following examples only schematically illustrate the basic concept of the present application, and the following examples and features in the examples can be combined with each other without conflict.

[0031] The present application provides a low time-delay continuous authentication network. The network aims to fully capture the long-term dependencies in behavioral biometric sequences by introducing global attention mechanisms and spatio-temporal attention mechanisms, and to enhance the robustness of the model to noise and outliers. By effectively fusing multi-sensor data and global features at different time points, the network finally realizes high-precision legitimacy verification of user identity within a small authentication window.

[0032] The problem of the conventional scaled dot-product attention mechanism that cannot be effectively applied in resource-constrained networks due to quadratic computational complexity is solved. For this purpose, the present application designs a new attention mechanism based on a linear gated unit (GLU). The mechanism has linear computational complexity and is a lightweight alternative that can efficiently capture global dependencies in time series data with high discriminability while producing only a small computational overhead.

[0033] In order to efficiently deploy the continuous authentication model on resource-constrained mobile devices, the present application provides a highly lightweight hybrid network structure. The structure significantly reduces the model complexity by combining classic CNN lightweight methods such as deep convolution and point convolution, and classic MLP lightweight methods such as the squeeze-and-excitation network (SE). In addition, by designing a new multi-subspace MLP method, the model is further compressed without increasing the network burden, ultimately forming a complete solution suitable for mobile devices, low power consumption and low latency.

[0034] As shown in Figure 1 The lightweight low-latency continuous authentication system based on the linear attention hybrid network provided by the present application includes: The data acquisition and preprocessing module is configured to acquire user behavior data from the built-in sensors of the mobile device in real time, and normalize and segment the data; the lightweight hybrid feature extraction module is connected with the data acquisition and preprocessing module, and is configured to receive the preprocessed data and extract local fine-grained features and global timing features of the user behavior by using the double-flow architecture in the module; the authentication decision module is connected with the lightweight hybrid feature extraction module, and is configured to match the extracted features with the registered legal user behavior profile to determine whether the current user identity is legal, and perform corresponding access control operations.

[0035] Specifically, the data acquisition and preprocessing module is specifically configured to acquire data from the built-in accelerometer and gyroscope sensors; the acquired data is a six-dimensional vector, including linear acceleration (Ax, Ay, Az) of the accelerometer on three axes and angular velocity (Gx, Gy, Gz) of the gyroscope on three axes; the minimum-maximum normalization method is used to independently normalize the data on each sensor axis; the normalized data is segmented into non-overlapping 2-second time windows, and each window contains 200 samples at a sampling rate of 100 Hz.

[0036] The lightweight hybrid feature extraction module is an LHGT module, which further includes: a local flow that uses MobileNetV2-based blocks to capture fine-grained spatial features; a global flow that uses GLU-based Transformer blocks and spatio-temporal attention to model broader timing features; a global-local interaction module that uses a cross-attention mechanism to dynamically facilitate feature exchange between the local flow and the global flow output; a feature fusion and classification head that is configured to first adaptively fuse accelerometer and gyroscope features as local features through a self-attention mechanism, and then process them together with global features through a multi-subspace MLP to generate final fusion features for authentication.

[0037] The system operates in two stages: The registration stage: in this stage, the system collects the behavior data of the algorithm user, trains the lightweight hybrid feature extraction module to establish the personalized behavior model of the user, and stores the model parameters on the mobile device to form the legal user behavior profile; The authentication stage: in this stage, the system acquires the behavior data of the current user in real time, extracts features by using the trained model, and matches and authenticates with the registered legal user behavior profile.

[0038] The lightweight low-delay continuous authentication method based on linear attention hybrid network provided by the application includes the following steps: Registration phase steps: S11: Collecting algorithm user behavior data generated by built-in sensors on mobile devices; S12: Preprocessing the collected behavior data, including normalization and data segmentation; S13: Sending the preprocessed data to the server for training a lightweight hybrid feature extraction model; S14: Receiving the trained model parameters returned from the server, establishing and storing the behavior profile of the legitimate user locally on the mobile device; Authentication phase steps: S21: Triggering the system to collect real-time user behavior data when the user interacts with the mobile device; S22: Preprocessing the real-time collected behavior data in the same way as S12; S23: Inputting the preprocessed data into the trained lightweight hybrid feature extraction model to extract behavior features; S24: Matching the extracted behavior features with the legitimate user behavior profile stored locally to determine whether the current user is a legitimate user; S25: If the user is determined to be legitimate, the session is maintained; if the user is determined to be illegitimate, the device is locked.

[0039] When collecting data, six-dimensional vector data (Ax, Ay, Az, Gx, Gy, Gz) is collected from the accelerometer and gyroscope; The formula Min-max normalization is performed on data j on each sensor axis i; the normalized data is segmented into non-overlapping 2-second time windows.

[0040] The lightweight hybrid feature extraction model in steps S13 and S23 uses a dual-stream architecture for feature extraction, which includes: capturing fine-grained spatial features through a local stream; modeling global temporal features through a global stream; dynamically fusing the output features of the local stream and the global stream through a global-local interaction module using a cross-attention mechanism; adaptively fusing accelerometer and gyroscope features through a self-attention mechanism, and processing them together with global features via a multi-subspace MLP to generate fusion features that comprehensively represent local and global behavior features.

[0041] In Figure 1As can be seen, the present application designs a model named LHGT, which aims to efficiently promote the interaction between global information and local information, so as to extract representative features from sensor data. The lightweight hybrid network architecture can achieve high-precision classification even in a resource-limited environment. As shown in FIG. 2, LHGT is composed of four modules: local stream, global stream, global-local interaction module, and classification head. Specifically, the data of the accelerometer and the gyroscope are input into a dual-path architecture: local stream and global stream. The local stream adopts a CNN pyramid structure, including a Stem layer and four local feature extraction blocks (LFEB), which process the accelerometer and gyroscope data respectively to learn fine-grained temporal features. The global stream is composed of an embedding layer and four GLU-based Transformer blocks (GBTB), which capture long-range spatio-temporal dependencies in user behavior patterns using attention mechanisms. The features of the corresponding layers of the LFEB and the GBTB are cross-attention fused by the global-local interaction module, and the output is passed to the subsequent layer to realize the mutual optimization of global and local representations. The global and local features are processed by the classification head respectively: the local CNN stream fuses six-axis data through an accelerometer and gyroscope adaptive fusion module (AGAF), which adopts a self-attention mechanism; then, the local features are reshaped and processed by a multi-subspace MLP (MSMLP); at the same time, the global features are also reshaped and processed by the MSMLP; finally, the global and local features are spliced and output the classification result through a fully connected layer. The overall structure of LHGT is shown in Table 1. The local stream, global stream, global-local interaction module, and classification head are described in detail as follows.

[0042] Table 1, LHGT structure

[0043] Local feature extraction block (LFEB) structure: Traditional CNN structure parameters are large and the amount of calculation is large, which is not suitable for mobile devices. The local feature extraction block (LFEB) is designed in the application, and the MobileNetV2 structure as shown in Table 2 is used as a reference to process the accelerometer and gyroscope data respectively. Each LFEB is composed of a MobileNetV2 downsampling block and an inverted residual block, and is stacked four times. MobileNetV2 downsampling block: The depth separable convolution structure is adopted, including pointwise convolution, depth convolution and pointwise convolution again. The input feature map is CxT, which is first expanded to C1 through pointwise convolution, activated by ReLU6, and then down-sampled to T / 2 by depth convolution with a step of 2 (s=2), and then compressed to C2. The pointwise convolution adopts a group number of 2, and the three-axis data of the accelerometer and the gyroscope are processed respectively, which significantly reduces the parameter amount and the calculation complexity. MobileNetV2 inverted residual block: The structure is the same as the downsampling block, but the step is 1 (s=1), the channel number is kept C=C2

[0044] Table 2, MobileNetV2 structure

[0045] Residual connection is introduced between the input and the output to enhance information flow. Convolution operation is also grouped according to sensor type, taking into account efficiency and feature independence.

[0046] Behavioral data has significant scale differences between different activities, and each axis data of the same sensor presents a complex and diverse pattern, so local and global dependencies need to be modeled simultaneously. The calculation complexity of the traditional Transformer is O (N 2 ), which is difficult to deploy on resource-constrained terminals.

[0047] The application proposes a GLU-based Transformer block (GBTB) to replace the standard attention with a lightweight linear spatio-temporal attention module, which significantly reduces the amount of calculation and maintains high accuracy. The global flow input is sequentially input into the data embedding layer and four GBTBs, and each GBTB contains a GLU-based spatio-temporal attention submodule as shown in Figure 2 .

[0048] GLU-based spatio-temporal attention: The application proposes a lightweight spatio-temporal attention mechanism that uses GLU to effectively model temporal and spatial dependencies while reducing complexity. In temporal attention, the input feature matrix is first transposed to , and then the temporal weight is calculated by GLU, and the steps are as follows: the global average pooling is performed on the transposed input to obtain a compressed representation with a shape of ; a linear layer projects it to a low-dimensional space (Compression ratio r=10), upsampled back after ReLU activation ; the resulting weights are Hadamard multiplied with the input to generate the temporal weighted features, which are then converted back to spatial features. The spatial attention stage also adopts GLU (r=2) to calculate the importance of sensor channels, with the formula where denotes the Hadamard product; , followed by a linear transformation and layer normalization to ensure training stability. This two-stage GLU attention simultaneously obtains rich spatial-temporal representations at low complexity, making it suitable for mobile device deployment.

[0049] Interaction design: Traditional CNNs are good at extracting local fine-grained features but have difficulty capturing long-range dependencies; Transformers can model global dependencies but are computationally expensive. This invention proposes a lightweight global-local interaction module that combines the advantages of both and avoids their shortcomings. The input data is processed through both global and local streams, and then fused through a global-local interaction module. This invention further proposes a global-local adaptive fusion (GLAF) method based on cross-attention, as shown in Figure 3 , which includes two sub-modules: Global-to-Local (G2L) and Local-to-Global (L2G). G2L enriches local features with global context, and L2G enhances global features with local details, achieving bidirectional reinforcement and obtaining a more expressive fused representation.

[0050] GLAF: To achieve efficient and lightweight global-local feature fusion, this invention introduces the GLAF module. The input is the global feature and the local feature . As Figure 3 , the fusion output is:

[0051] where α is a learnable adaptive weight. GLU dynamically learns channel weights, emphasizing important channels and suppressing less important channels; then, through a deep feature fusion network, a nonlinear mapping is performed to capture and complex dependencies. Finally, each weighted feature is Hadamard multiplied with the original input and accumulated to obtain the fusion result Z. This strategy is computationally efficient and has strong expressive power, making it suitable for resource-constrained scenarios. Implementation: The global-local interaction module, as shown in Figure 4 , includes G2L and L2G.

[0052] G2L: The input local feature and the global feature . Firstly, the local flow accelerometer and gyroscope features are fused through the self-attention AGAF module. Secondly, the global and local features are respectively input into the MSMLP to extract low-dimensional subspace semantics. Finally, the classification results are output through the Dense layer. The structure complementarily utilizes global and local information and is lightweight and efficient as a whole. The AGAF module is based on self-attention and uses the GLU gate to learn the channel weight and perform Hadamard product, dynamically highlighting key channels and suppressing redundant channels, thereby improving the robustness and accuracy of features. The MSMLP is a lightweight scheme based on “multi-subspace decomposition” to reduce the calculation and memory overhead of traditional multi-layer perceptron (MLP). The input tensor is denoted as X, the conventional MLP requires weights W and bias b, the parameter quantity is O(W) + O(b), the calculation quantity is O(XW) + O(Xb), the output is Y, and the total parameter quantity is O(W) + O(b). The parameter quantity and calculation quantity of the present architecture are reduced to 1 / n of the conventional MLP, while maintaining high expression capability and significantly improving efficiency. The parameter quantity and calculation quantity of the present architecture are reduced to 1 / n of the conventional MLP, while maintaining high expression capability and significantly improving efficiency. The parameter quantity and calculation quantity of the present architecture are reduced to 1 / n of the conventional MLP, while maintaining high expression capability and significantly improving efficiency.

[0053] L2G: The input is the same as G2L. The FG is reshaped and linearly mapped to obtain The transpose is performed and point-wise convolution is performed to obtain The two GLAF fusions are sequentially performed to obtain Point-wise convolution and transposition are performed to obtain The residual error is added to the output of the enhanced global feature; the calculation complexity is . .

[0054] Classification head design: the present application proposes a lightweight mixed classification head, which fuses global and local behavior features in three steps. Firstly, the local flow accelerometer and gyroscope features are fused through the self-attention AGAF module.

[0055] Secondly, the global and local features are respectively input into the MSMLP to extract low-dimensional subspace semantics. Finally, the classification results are output through the Dense layer. The structure complementarily utilizes global and local information and is lightweight and efficient as a whole. The AGAF module is based on self-attention and uses the GLU gate to learn the channel weight and perform Hadamard product, dynamically highlighting key channels and suppressing redundant channels, thereby improving the robustness and accuracy of features. The MSMLP is a lightweight scheme based on “multi-subspace decomposition” to reduce the calculation and memory overhead of traditional multi-layer perceptron (MLP). The input tensor is denoted as X, the conventional MLP requires weights W and bias b, the parameter quantity is O(W) + O(b), the calculation quantity is O(XW) + O(Xb), the output is Y, and the total parameter quantity is O(W) + O(b). The parameter quantity and calculation quantity of the present architecture are reduced to 1 / n of the conventional MLP, while maintaining high expression capability and significantly improving efficiency. The parameter quantity and calculation quantity of the present architecture are reduced to 1 / n of the conventional MLP, while maintaining high expression capability and significantly improving efficiency.

[0056] Embodiment: In this embodiment, the overall performance of LHGT is evaluated by changing the number of unseen users, using indicators such as EER, FAR, FRR, accuracy, and f1 score. In order to evaluate more intuitively, a user is randomly selected from 70 users as a legitimate user. From the remaining 69 users, N impostors are selected, where N is 10, 20, 30, 40, and 50. Each user in this experiment is used as a legitimate user, and the experiment is repeated 70 times, and the average result is taken as the final result. As shown in Table 3, this embodiment uses the results of 70 times to make a box plot of the data of LHGT, Transformer, Mobile-Former-26, and MobileNetV2. It can be seen that the accuracy indicators of our LHGT, including ACC, F1, and EER, are optimal in different unseen user cases, and have high accuracy and stability. Figure 5 In this embodiment, it can be seen that as the number of unseen users increases, the average EER slightly rises, but is still below 1%. Similarly, although the accuracy gradually decreases, it remains above 99%. In addition, the f1 score slightly decreases, but remains above 99%. These results highlight the good performance of LHGT in continuous identity verification tasks. Overall, LHGT shows stable and efficient performance in continuous user authentication tasks.

[0057] Table 3, Comparison of representative works on the dataset of this embodiment

[0058] GLAF Effect Evaluation: To verify the fusion ability of GLAF module, four common strategies, additive fusion, splicing fusion, dot product attention fusion (DPA), and deep feature fusion (DFF), are compared. Table 4 shows that LHGTAuth integrated with GLAF leads in all five indicators: EER drops to 0.97%, 10.2% lower than the previous best DPA (1.12%); FRR is only 0.25%, better than DPA's 0.33%; accuracy and F1-score both reach 99.02%, an increase of 0.16% over DPA. Although FAR did not reach the best, the overall indicators exceeded other models. The above multi-dimensional improvement confirms that GLAF achieves the current best authentication performance.

[0059] Table 4, Comparison of different fusion methods

[0060] To verify the effectiveness of MSMLP in the classification head, it is compared with the standard MLP. While keeping the rest of the modules completely the same, only MSMLP is replaced with the traditional MLP and tested on the same dataset. Table 5 summarizes the average EER, FAR, FRR, accuracy, F1 score, computational cost (MAdds) and parameter quantity. The results show that the precision indicators of MSMLP are almost the same as those of the standard MLP, but the computational cost is reduced by 14.94% and the parameter quantity is reduced by 50.2%, verifying the efficiency and applicability of MSMLP in resource-constrained environments.

[0061] Table 5, performance of MSMLP

[0062] GLU-Transformer efficiency evaluation: To verify the efficiency of the proposed GLU-Transformer, this embodiment compares it with representative Transformer models commonly used in time series analysis, including standard Transformer, Autoformer, Reformer and Informer. In the experiment, only the GLU module is replaced with the above alternatives, and the rest of the system components remain unchanged. Table 6 shows that the GLU-Transformer of the present application achieves the lowest EER (0.97%) and the highest F1 score (99.02%) among all participating models. In terms of computational efficiency, it also has the smallest overhead, requiring only 1MMacs of computational cost and 173.92k parameters. Although other baseline models perform well in their original fields, they perform poorly in continuous authentication tasks. This performance gap can be attributed to two key factors: 1) these models are originally designed for different problem domains, such as time series prediction or natural language processing, while continuous authentication involves a specialized temporal classification task; 2) their deeper and more complex architecture usually relies on large-scale training data, while the data in the behavior authentication scenario is often limited, which cannot meet this assumption.

[0063] Table 6, performance verification of Former

[0064] Sensor combination impact: To evaluate the impact of different sensor combinations on the performance of LHGTAuth, this embodiment tests all cases from single sensor (accelerometer, gyroscope, magnetometer) to three-sensor full combination, and the results are listed in Table 7.

[0065] Single sensor: The gyroscope performed best, with an EER of 1.20% and an accuracy of 98.79%; the accelerometer was second best (EER 5.24%, accuracy 94.74%); and the magnetometer performed worst (EER 30.68%, accuracy 69.45%). Dual sensor: The accelerometer + gyroscope combination achieved the best overall performance, with an EER of 0.97% and an accuracy of 99.02%. Triple sensor: The overall performance decreased after introducing the magnetometer, presumably due to its low seasonality and irregular data, making it difficult for the model to utilize.

[0066] To prove this hypothesis, a seasonal-trend decomposition was further performed on the nine-axis time series data of 10 users:

[0067]

[0068] The results are as follows Figure 6 As shown, the seasonality intensity ranking is consistent across all users: gyroscope > accelerometer >> magnetometer, verifying the conclusion that the magnetometer's weakest regularity leads to a decline in authentication performance.

[0069] Table 7. Sensor Combination Validation

[0070] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A lightweight, low-latency continuous authentication method based on a linear attention hybrid network, characterized in that, The method specifically includes the following steps: S1. Registration phase: Collect and preprocess the behavioral data of legitimate users; train a lightweight hybrid feature extraction model to establish and store user behavior profiles; S2, Authentication Phase: Real-time collection and preprocessing of user behavior data, extraction of behavioral features and matching with stored behavioral profiles, and execution of access control operations based on the matching results.

2. The lightweight, low-latency continuous authentication method based on a linear attention hybrid network according to claim 1, characterized in that, Step S1 specifically includes: S11. On mobile devices, collect behavioral data generated by legitimate users through built-in sensors; S12. Preprocess the collected behavioral data, including normalization and data segmentation; S13. Send the preprocessed data to the server for training a lightweight hybrid feature extraction model; S14. Receive the trained model parameters returned from the server, and build and store the behavioral profile of the legitimate user locally on the mobile device.

3. The lightweight, low-latency continuous authentication method based on a linear attention hybrid network according to claim 2, characterized in that, Step S2 specifically includes: S21. When a user interacts with a mobile device, the system is triggered to collect real-time user behavior data; S22. Perform the same preprocessing as step S12 on the real-time collected behavioral data; S23. Input the preprocessed data into the trained lightweight hybrid feature extraction model to extract behavioral features; S24. Match the extracted behavioral features with the legal user behavior profile stored locally to determine whether the current user is a legal user; S25. If the user is determined to be legitimate, maintain the session; if the user is determined to be illegitimate, lock the device.

4. The lightweight, low-latency continuous authentication method based on a linear attention hybrid network according to claim 3, characterized in that, The collected user behavior data includes: Acquire six-dimensional vector data (Ax, Ay, Az, Gx, Gy, Gz) from accelerometers and gyroscopes. Use formula Minimum-maximum normalization is performed on the data j on each sensor axis i; the normalized data is divided into non-overlapping 2-second time windows, with each window containing 200 samples at a sampling rate of 100Hz.

5. The lightweight, low-latency continuous authentication method based on a linear attention hybrid network according to claim 4, characterized in that, The lightweight hybrid feature extraction model described in steps S13 and S23 uses a two-stream architecture for feature extraction. The process includes: capturing fine-grained spatial features through local streams; and modeling global temporal features through global streams. The output features of local and global streams are dynamically fused through a global-local interaction module using a cross-attention mechanism. Accelerometer and gyroscope features are adaptively fused through a self-attention mechanism and then processed together with global features via a multi-subspace MLP to generate fused features that comprehensively represent local and global behavioral features.

6. The lightweight, low-latency continuous authentication method based on a linear attention hybrid network according to claim 5, characterized in that, The lightweight hybrid feature extraction model aims to efficiently facilitate the interaction between global and local information, thereby extracting representative features from sensor data. This model consists of four modules: a local flow module, a global flow module, a global-local interaction module, and a classification head, specifically including: Accelerometer and gyroscope data are input into a dual-path architecture: local stream and global stream. The local stream uses a CNN pyramid structure, including a Stem layer and four Local Feature Extraction Blocks (LFEBs), which process the accelerometer and gyroscope data respectively to learn fine-grained temporal features. The global stream consists of an embedding layer and four GLU-based Transformer Blocks (GBTBs), which use an attention mechanism to capture long-range spatiotemporal dependencies in user behavior patterns. The features of the corresponding layers of LFEB and GBTB are fused through cross-attention using a global-local interaction module, and the output is passed to subsequent layers to achieve mutual optimization of global and local representations. The global and local features are processed by the classification head respectively: the local CNN stream is fused with six-axis data through the accelerometer and gyroscope adaptive fusion module AGAF, which adopts a self-attention mechanism. Subsequently, local features are reshaped and processed by multi-subspace MSMLP; at the same time, global features are also reshaped and processed by MSMLP; finally, global and local features are concatenated and the classification result is output through a fully connected layer.

7. A lightweight, low-latency, continuous authentication system based on a linear attention hybrid network, characterized in that, The system includes: a data acquisition and preprocessing module, a lightweight hybrid feature extraction module, and an authentication decision module; The data acquisition and preprocessing module is configured to acquire user behavior data in real time from the built-in sensors of the mobile device, and to normalize and segment the data. The lightweight hybrid feature extraction module is connected to the data acquisition and preprocessing module and is configured to receive preprocessed data and extract local fine-grained features and global temporal features of user behavior using its internal dual-stream architecture. The authentication decision module is connected to the lightweight hybrid feature extraction module and is configured to match the extracted features with the behavioral profiles of registered legitimate users to determine whether the current user's identity is legitimate and to perform corresponding access control operations.

8. The lightweight, low-latency continuous authentication system based on a linear attention hybrid network according to claim 7, characterized in that, The data acquisition and preprocessing module is specifically configured as follows: it acquires data from the built-in accelerometer and gyroscope sensors; the acquired data is a six-dimensional vector, including the linear acceleration (Ax, Ay, Az) of the accelerometer on three axes and the angular velocity (Gx, Gy, Gz) of the gyroscope on three axes; it uses the min-max normalization method to independently normalize the data on each sensor axis; and it divides the normalized data into non-overlapping 2-second time windows, with each window containing 200 samples at a sampling rate of 100Hz.

9. The lightweight, low-latency continuous authentication system based on a linear attention hybrid network according to claim 8, characterized in that, The lightweight hybrid feature extraction module is an LHGT module, comprising: a local stream, which uses MobileNetV2-based blocks to capture fine-grained spatial features; a global stream, which uses GLU-based Transformer blocks and spatiotemporal attention to model broader temporal features; a global-local interaction module, which utilizes a cross-attention mechanism to dynamically promote feature exchange between the outputs of the local stream and the global stream; and a feature fusion and classification head, configured to first adaptively fuse accelerometer and gyroscope features as local features through a self-attention mechanism, and then process them together with global features through a multi-subspace MLP to generate the final fused features used for authentication.

Images