Identity verification method and device, equipment, storage medium and program product

Abstract

The invention provides an identity verification method and device, equipment, a storage medium and a program product, and relates to the technical field of financial science and technology or the technical field of artificial intelligence. The method comprises the following steps: responding to a transaction operation triggered by a user, and collecting multi-modal data of the user, the multi-modal data comprising biological data, behavior data and environmental data; extracting a feature vector of the multi-modal data; and inputting the feature vector of the multi-modal data into a machine learning model, and generating a risk assessment result indicating the user identity risk. According to the method provided by the invention, the identity verification security and accuracy can be improved.

Description

Technical Field

[0001] This application relates to the fields of financial technology or artificial intelligence technology, and in particular to an authentication method, device, equipment, storage medium and program product. Background Technology

[0002] In the context of digital banking services, users need to verify their identity when conducting transactions to ensure transaction security.

[0003] In related technologies, identity verification relies on passwords, SMS verification codes, or facial recognition. While these methods achieve the purpose of identity verification, there is still room for improvement in terms of accuracy, security, and user experience. Summary of the Invention

[0004] This application provides an authentication method, apparatus, device, storage medium, and program product to improve the security and accuracy of authentication.

[0005] In a first aspect, this application provides an identity verification method, comprising: in response to a user triggering a transaction operation, collecting the user's multimodal data, including biological data, behavioral data, and environmental data; extracting feature vectors from the multimodal data; and inputting the feature vectors from the multimodal data into a machine learning model to generate a risk assessment result indicating the risk of the user's identity.

[0006] In one possible embodiment, before extracting the feature vectors of the multimodal data, the authentication method further includes: performing the following preprocessing on the multimodal data and updating the multimodal data with the preprocessed multimodal data: cleaning the multimodal data; aligning and normalizing the cleaned biological data; normalizing and timestamp aligning the cleaned behavioral data; and standardizing the format of the cleaned environmental data.

[0007] In one possible embodiment, extracting the feature vector of multimodal data includes: extracting features from biological data to obtain biological features, which include at least one of the following: facial features, voiceprint features, and fingerprint features; extracting features from behavioral data to obtain behavioral features, which include at least one of the following: standard deviation of input speed, cluster center of click location, and quantile of page dwell time; performing associative label mapping processing on environmental data to obtain environmental features; and fusing the biological features, behavioral features, and environmental features to obtain the feature vector of multimodal data.

[0008] In one possible embodiment, inputting the feature vectors of multimodal data into a machine learning model to generate risk assessment results indicating user identity risk includes one of the following: converting the feature vectors of multimodal data into a graph structure, aggregating the graph structure using a graph neural network, and predicting the risk assessment results; inputting the feature vectors of multimodal data into each decision tree of a gradient boosting tree, generating correction values, and generating risk assessment results based on the initial prediction values ​​and correction values; serializing the feature vectors of multimodal data to generate sequence vectors, and performing attention processing on the sequence vectors using a transformer model to predict the risk assessment results.

[0009] In one possible embodiment, after generating a risk assessment result indicating the risk of user identity, the method further includes: calculating the similarity between the feature vector of the multimodal data and the existing risk feature vectors in the risk feature library; determining the target risk feature vector from the risk feature library based on the similarity; and adjusting and updating the risk assessment result to the risk assessment label of the target risk feature vector if the risk assessment label of the target risk feature vector is different from the risk assessment result and the similarity is greater than or equal to the similarity threshold.

[0010] In one possible embodiment, after generating a risk assessment result indicating the risk to the user's identity, the method further includes: if the risk assessment result indicates a first risk level, implementing a seamless passage strategy; if the risk assessment result indicates a second risk level, implementing a secondary verification strategy; and if the risk assessment result indicates a third risk level, implementing a forced blocking strategy.

[0011] In one possible embodiment, feature vectors of multimodal data are extracted and deployed on a user terminal. The user terminal extracts feature vectors of multimodal data through a lightweight model and sends the feature vectors of multimodal data to a server. The server then deploys a machine learning model.

[0012] In one possible embodiment, the lightweight model is obtained through one of the following processes: model pruning, quantization compression, and knowledge distillation.

[0013] Secondly, this application provides an identity verification device, comprising: a collection module for collecting multimodal data of the user in response to a user triggering a transaction operation, the multimodal data including biological data, behavioral data and environmental data; a feature extraction module for extracting feature vectors from the multimodal data; and a risk assessment module for inputting the feature vectors of the multimodal data into a machine learning model to generate a risk assessment result indicating the risk of the user's identity.

[0014] Thirdly, this application provides an electronic device, including: a processor and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method as described in any of the first aspects.

[0015] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any of the first aspects.

[0016] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the method of any one of the first aspects.

[0017] In this embodiment, multimodal data of the user is collected in response to a user-triggered transaction. This collection is synchronized with the user's transaction trigger, ensuring the real-time nature of the multimodal data and subsequent identity verification and risk assessment. By extracting feature vectors from the multimodal data, these vectors can represent the user's biometric, behavioral, and environmental characteristics. Compared to identity verification based on a single dimension of biometrics, this embodiment offers higher accuracy and security for subsequent identity verification and risk assessment based on feature vectors from multimodal data. By inputting the feature vectors from the multimodal data into a machine learning model, identity verification and risk assessment can be performed automatically. Attached Figure Description

[0018] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0019] Figure 1 This is a schematic diagram illustrating an application scenario of the identity verification method according to an embodiment of this application;

[0020] Figure 2 This is a flowchart of the authentication method according to an embodiment of this application;

[0021] Figure 3 A flowchart illustrating an authentication scheme according to yet another embodiment of this application;

[0022] Figure 4 This is a schematic diagram of an authentication device according to an embodiment of this application;

[0023] Figure 5 This is a schematic diagram of an electronic device according to an embodiment of this application.

[0024] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0025] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0026] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with the relevant laws, regulations, and standards of the relevant countries and regions, have taken necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation access points for users to choose to authorize or refuse.

[0027] Furthermore, the technical solution involved in this application, which involves big data analysis of user information (including but not limited to personal biometrics, identity data, consumption data, asset data, electronic terminal operation data, etc.) and the use of artificial intelligence technology for automated decision-making, and makes decisions that have a significant impact on personal rights based on the results of automated decision-making, provides users with corresponding operation entry points for users to choose to agree to or reject the results of automated decision-making; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0028] It should be noted that the authentication methods, devices, equipment, storage media, and program products provided in this application can be used in the fields of financial technology or artificial intelligence, or in any field other than financial technology or artificial intelligence. The application fields of the authentication methods, devices, equipment, storage media, and program products in this application are not limited.

[0029] Figure 1 This is a schematic diagram illustrating an application scenario of an embodiment of this application.

[0030] like Figure 1As shown, user 1's terminal device 2 has a financial application 3 installed, and user 1 performs transaction operations through the financial application 3. In response to user 1 triggering the transaction operation, the financial institution's server 4 executes the authentication method of this embodiment to verify whether the user is the current account holder. The transaction is executed after successful authentication.

[0031] Alternatively, User 1 may conduct a transaction through an Automated Teller Machine (ATM) of a financial institution. In response to User 1 triggering the transaction, the financial institution's server 4 executes the authentication method of this embodiment to verify whether the user is the current account holder. The transaction is executed after successful authentication.

[0032] In related technology 1, authentication is performed using a password and SMS verification code, or using a USB-based hardware digital certificate storage medium (USB Key, U-shield) and a static password. This method has significant security vulnerabilities; for example, passwords are easily brute-forced or stolen via phishing, and SMS verification codes may be intercepted through SIM card cloning attacks.

[0033] Related technology 2 introduces biometrics such as facial recognition and fingerprint recognition as auxiliary identity verification methods. However, this method has limited ability to identify forgery attacks (such as photos, videos, and 3D masks) and is greatly affected by environmental factors (such as lighting and angle), resulting in fluctuations in recognition accuracy.

[0034] In related technology 3, biometrics and passwords, or a combination of facial recognition and SMS verification codes, are used to improve identity verification security. However, this method requires users to perform multiple operations (such as taking a picture of their face, entering a password, and receiving an SMS), which significantly reduces the user experience.

[0035] Furthermore, many related technologies rely on post-event verification or in-process interception based on fixed rules (such as verification triggered by large transactions). However, fixed rules are insufficient to cover new risks, resulting in high rates of missed or false positives in identity verification and risk assessment. In addition, user operating habits, device environment, and other data are scattered across various business systems, lacking unified correlation analysis and real-time modeling capabilities, thus failing to form a dynamic identity verification and risk assessment system.

[0036] The authentication method provided in this application is intended to address at least one of the aforementioned technical problems in related technologies.

[0037] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0038] Figure 2 This is a flowchart illustrating an authentication method according to an embodiment of this application. The authentication method can be executed by an electronic device, specifically a user terminal or a financial institution's server. The following description will use the example of the authentication method being executed by a server.

[0039] like Figure 2 As shown, the authentication method of this application embodiment includes steps S110 to S130.

[0040] S110: In response to a user-triggered transaction, collect the user's multimodal data.

[0041] Multimodal data refers to heterogeneous data from different sensors or data sources. Multimodal data includes biological data, behavioral data, and environmental data.

[0042] Combination Figure 1 The application scenario shown illustrates that the data acquisition module for collecting multimodal data can be installed in a financial application or an ATM. Responding to a user-triggered transaction, collecting the user's multimodal data can be understood as the server responding to the user's transaction by sending a multimodal data acquisition command to the financial application or ATM. The acquisition module then executes the multimodal data acquisition operation based on the command, and the collected multimodal data can be sent to the server.

[0043] To illustrate with a specific example: Biometric data includes at least one of facial images, audio data, and fingerprint data; behavioral data represents the user's operation trajectory, including at least one of input speed (i.e., the speed at which data is entered into the input box), button click location, and page dwell time; environmental data includes at least one of the following: user's geographical location, device model data of the user's login account, device model, operating system version, device hardware unique identifier (International Mobile Equipment Identity, IMEI), user network identity (International Mobile Subscriber Identity, IMSI), Internet Protocol (IP) address, and Wi-Fi name.

[0044] The data acquisition module includes an image acquisition unit (such as a camera) for capturing facial images, an audio acquisition unit for capturing audio data, and a fingerprint sensor for capturing fingerprint data. The module also includes a code module implemented using embedded tracking technology, which is installed on the device used to log in to the account and is used to collect the aforementioned behavioral data. The module further includes a positioning unit (for collecting the user's geographical location), a device fingerprint detection unit (for collecting device model, operating system version, IMEI, and IMSI), and a network status detection unit (for collecting IP address and Wi-Fi name).

[0045] S120. Extract the feature vectors from the multimodal data.

[0046] The feature vector of multimodal data is a numerical representation of the multimodal data that is representative. The feature vector of multimodal data can represent the user's biological characteristics, behavioral characteristics, and environmental characteristics.

[0047] S130. Input the feature vectors of the multimodal data into the machine learning model to generate risk assessment results that indicate the risk of user identity.

[0048] Machine learning models are algorithmic models that learn patterns from samples, extract features from data, establish input-output mappings, and make predictions or decisions based on new data. For example, machine learning models can be used to automate identity verification and risk assessment based on feature vectors of multimodal data, and output risk assessment results.

[0049] For example, the risk assessment result indicates one of a first risk level, a second risk level, and a third risk level. The first risk level, the second risk level, and the third risk level indicate the probability that the user is the user themselves in a first probability interval, a second probability interval, and a third probability interval, respectively. The first probability interval is higher than the second probability interval, and the second probability interval is higher than the third probability interval. For example, the first probability interval is (75, 100], the second probability interval is [35, 75], and the third probability interval is [0, 35].

[0050] In this embodiment, multimodal data of the user is collected in response to a user-triggered transaction. This collection is synchronized with the user's transaction trigger, ensuring the real-time nature of the multimodal data and subsequent identity verification and risk assessment. By extracting feature vectors from the multimodal data, these vectors can represent the user's biometric, behavioral, and environmental characteristics. Compared to identity verification based on a single dimension of biometrics, this embodiment offers higher accuracy and security for subsequent identity verification and risk assessment based on feature vectors from multimodal data. By inputting the feature vectors from the multimodal data into a machine learning model, identity verification and risk assessment can be performed automatically.

[0051] In one possible embodiment, before extracting the feature vector of the multimodal data in step S120, the authentication method may further include: performing the following preprocessing on the multimodal data and updating the multimodal data with the preprocessed multimodal data: data cleaning of the multimodal data; alignment and normalization of the cleaned biological data; normalization and timestamp alignment of the cleaned behavioral data; and format standardization of the cleaned environmental data.

[0052] Data cleaning is used to remove duplicate data, correct or remove abnormal data in multimodal data, and ensure the quality of multimodal data participating in subsequent feature extraction.

[0053] Taking biological data, including facial images, as an example, data cleaning can remove duplicate facial images and perform Gaussian filtering to remove noise. Alignment and normalization processing of the cleaned biological data can include aligning key points in the facial image (such as 68-point facial localization) and normalizing the size and resolution of the aligned facial image.

[0054] Normalization and timestamp alignment are performed on the cleaned behavioral data to unify the numerical range of the behavioral data into a fixed interval to eliminate numerical differences. Timestamp alignment can eliminate the time offset of the behavioral data.

[0055] In this embodiment, preprocessing of multimodal data can prevent invalid or abnormal data from interfering with subsequent feature extraction and machine learning judgment. Specifically, this embodiment further refines the preprocessing for biological, behavioral, and environmental data within the multimodal data. This enhances the robustness of the multimodal data, resulting in more representative features for subsequent feature extraction based on the preprocessed multimodal data, and higher reliability of the machine learning model.

[0056] Figure 3 This is a flowchart illustrating an authentication method according to another embodiment of this application. Figure 3 As shown, step S120, which involves extracting the feature vector of multimodal data, includes steps S121 to S124.

[0057] S121. Extract features from biological data to obtain biological features.

[0058] Biometrics include at least one of the following: facial features, voiceprint features, and fingerprint features. Biometrics are used to verify user identity.

[0059] For example, biometric data includes facial images, and the server can extract key point features from the facial images to obtain facial features.

[0060] For example, biological data includes audio data. The server can sequentially perform frame segmentation, Fourier transform, extract Mel-Frequency Cepstral Coefficients (MFCCs), and perform feature encoding on the Mel-Frequency Cepstral Coefficients to obtain voiceprint features.

[0061] For example, the biometric data includes fingerprint data in image format. The server can perform image enhancement processing on the fingerprint data, extract minutiae points (minutiae), and encode the minutiae features to obtain fingerprint features.

[0062] S122. Extract features from the behavioral data to obtain behavioral features.

[0063] Behavioral features include at least one of the following: standard deviation of input speed, cluster centers of click locations, and quantiles of page dwell time. These behavioral features are used to verify user habits, and thus, user identity.

[0064] For example, behavioral data includes input speed, and the server calculates the standard deviation of the input speed by comparing it with the historical input speed of historical behavioral data.

[0065] For example, behavioral data includes click locations, and the server calculates the cluster centers of the click locations using a clustering algorithm.

[0066] For example, behavioral data includes page dwell time, and the server can calculate the quantiles of page dwell time.

[0067] A quantile is a numerical point that divides a set of ordered data into several equal parts according to a certain ratio. Quantiles use proportion to locate the relative position of the data within the overall distribution. Specifically, quantiles of page dwell time can be used to define the range of page dwell time corresponding to each risk level indicated by various risk assessment results.

[0068] S123. Perform association label mapping on the environmental data to obtain environmental features.

[0069] Environmental features are used to verify the context in which a user performs a transaction, thereby verifying the user's identity.

[0070] Associative label mapping of environmental data refers to mapping environmental data to predefined associated labels. For example, comparing a user's login IP address with historical login records; if a match is found, it is labeled as a frequently used IP; otherwise, it is labeled as an unfamiliar IP. Environmental features include the aforementioned associated labels.

[0071] S124. Feature fusion is performed on biological characteristics, behavioral characteristics, and environmental characteristics to obtain feature vectors of multimodal data.

[0072] For example, the server can perform feature concatenation on biological features, behavioral features, and environmental features to achieve feature fusion. The feature vector of the resulting multimodal data has a dimension that is the sum of the dimensions of the biological features, behavioral features, and environmental features.

[0073] For example, when the dimensions of biological features, behavioral features, and environmental features are the same, the server can perform a weighted sum of biological features, behavioral features, and environmental features to achieve feature fusion.

[0074] In this embodiment, by performing fine-grained feature extraction on biological, behavioral, and environmental data from multimodal data and then fusing the extracted features, the information limitations of single-modal data can be overcome. The resulting feature vectors from the multimodal data are then input into a machine learning model to achieve comprehensive, accurate, and more attack-resistant identity verification and risk assessment.

[0075] In one possible embodiment, feature vectors of multimodal data are extracted and deployed on a user terminal. The user terminal extracts feature vectors of multimodal data through a lightweight model and sends the feature vectors of multimodal data to a server. The server then deploys a machine learning model.

[0076] User terminals refer to terminal devices used by users for operation, such as mobile phones, smart counters, or ATMs.

[0077] Lightweight models refer to edge computing models with low computational complexity.

[0078] In this embodiment, the feature vectors extracted from multimodal data are deployed on the user terminal. A lightweight model is used to process the multimodal data locally to extract the feature vectors. Subsequently, only the feature vectors of the multimodal data are uploaded to the server, reducing transmission latency and privacy risks. This embodiment reduces server load by deploying the extracted feature vectors on the user terminal, and the lightweight model reduces the computational resource consumption of the user terminal, ensuring that low-performance user terminals can efficiently extract feature vectors from multimodal data.

[0079] For example, a lightweight model is obtained through one of the following processes: model pruning, quantization compression, or knowledge distillation.

[0080] Model pruning refers to reducing model complexity by removing redundant parameters.

[0081] Quantization compression refers to reducing the storage and computational requirements of a model by lowering the numerical precision.

[0082] Knowledge distillation refers to the transfer of decision-making capabilities from a teacher model to a student model. When a lightweight model is obtained through knowledge distillation, the student model can be understood as a lightweight model deployed on the user's terminal. The teacher model can be deployed on a server.

[0083] In this embodiment, lightweight techniques can be flexibly selected. For example, model pruning can reduce the number of model parameters, quantization compression can reduce storage and computing resource consumption, and knowledge distillation can improve the efficiency of identity verification and risk assessment for low-performance user terminals. This ensures that feature vectors for extracting multimodal data can be efficiently extracted on different user terminals, thereby reducing the risk of privacy leakage while ensuring real-time performance.

[0084] like Figure 3 As shown, in one possible embodiment, the machine learning model includes one of the following: a graph neural network, a gradient boosting tree, or a transformer model. Step S130, which inputs the feature vector into the risk assessment model to generate a risk assessment result, includes one of steps S131 to S133.

[0085] S131. Convert the feature vectors of multimodal data into a graph structure, and use a graph neural network (GNN) to aggregate the graph structure and predict the risk assessment results.

[0086] For example, the feature vector corresponding to each transaction operation in the feature vector of multimodal data can be used as a node, and edges can be constructed based on the users, user terminals, etc. associated with the transaction operation, and an edge index can be generated. The weight of the edge is set according to the association strength; for example, the weight of the edge associated with the user of the transaction operation is greater than the weight of the edge associated with the user terminal. In this way, the feature vector can be converted into a graph structure.

[0087] The aggregation process is used to find the first-order associated nodes of each node by edge index, sum and normalize the feature vectors of the first-order associated nodes according to the edge weights to obtain aggregated features. The aggregated features are then fused with the node's own feature vectors through a linear transformation to obtain comprehensive features.

[0088] After nonlinear enhancement and multi-layer iteration, the comprehensive features yield the final node feature vector. A fully connected layer maps the final node feature vector to a risk probability value, and the risk assessment result is obtained by predicting the risk threshold corresponding to the risk probability value.

[0089] S132. Input the feature vectors of the multimodal data into each decision tree of the gradient boosting tree to generate correction values ​​and generate risk assessment results based on the initial prediction values ​​and correction values.

[0090] Each decision tree in a gradient boosting tree can capture a single authentication risk. The initial predictions consist of the mean risk probabilities obtained by training the gradient boosting tree using training samples.

[0091] After boosting each decision tree using the gradient of the feature vectors of the multimodal data, traversing the tree structure yields a correction value. The correction values ​​of all decision trees are then weighted and summed based on the learning rate. The sum of this weighted sum and the initial predicted value is used as the risk probability value. The risk assessment result is then predicted according to the risk threshold corresponding to the risk probability value.

[0092] S133. Serialize the feature vectors of multimodal data to generate sequence vectors, and perform attention processing on the sequence vectors using a transformer model to predict risk assessment results.

[0093] For example, the feature vector of multimodal data is split according to modality and a token sequence is generated. The token sequence is then positionally encoded to achieve serialization.

[0094] The transformer model maps sequence vectors to queries (Q), keys (K), and values ​​(V) through linear layers. The query, key, and value are split into multiple headers, and attention is computed in parallel on these headers. The attention features are concatenated from these headers. These attention features undergo residual connections, feedforward processing, and normalization, followed by global aggregation operations such as average pooling to obtain global features. Fully connected layers then map these global features to risk probability values. Risk assessment results are obtained by predicting risk thresholds corresponding to these risk probability values.

[0095] In this embodiment, specific machine learning models such as graph neural networks, gradient boosting trees, and transformer models can be used to perform identity verification and risk assessment on the feature vectors of multimodal data to generate risk assessment results. Specifically, graph neural networks can accurately identify identity verification risks with correlations and have a higher ability to identify and assess complex risks. Gradient boosting trees can improve the predictive ability of risk assessment results through multiple decision trees and have stronger interpretability. In addition, gradient boosting trees are adaptable to heterogeneous features and do not require transformation processing for feature vectors of multimodal data, making them suitable for the feature vector scenarios of multimodal data in this embodiment. The transformer model can capture more important identity verification risks in parallel through an attention mechanism, making it suitable for handling high-dimensional features and mitigating the curse of dimensionality caused by high-dimensional features, making it suitable for the specific scenario of high-dimensional feature vectors of multimodal data in this embodiment.

[0096] like Figure 2As shown, in one possible embodiment, after generating the risk assessment result indicating the user's identity risk in step S130, the authentication method further includes steps S140 to S160.

[0097] S140. Calculate the similarity between the feature vectors of the multimodal data and the existing risk feature vectors in the risk feature database.

[0098] A risk signature database is a database that stores historical authentication data, including risk signature vectors with risk assessment labels. These risk assessment labels indicate one of three risk levels: Level 1, Level 2, or Level 3.

[0099] For example, one existing risk feature vector indicates the user's own face and an input speed of 0.5 characters / second, corresponding to a risk assessment label of Level 1. This existing risk feature represents a transaction characteristic pattern of a normal user. Another example is an existing risk feature indicating a non-user's face, a different IP address, and an abnormal input speed, corresponding to a risk assessment label of Level 3. This existing risk feature represents a transaction characteristic pattern of a high-risk user.

[0100] For example, an electronic device can perform cosine similarity calculation on the existing risk feature vector and the feature vector of multimodal data to obtain a similarity score, which represents the degree of matching between the feature vector of multimodal data and the existing risk feature vector.

[0101] S150. Determine the target risk feature vector from the risk feature library based on similarity.

[0102] For example, the server can sort the feature vectors of multimodal data with the full set of risk feature vectors in the risk feature library and use the risk feature vector with the highest similarity as the target risk feature vector.

[0103] S160. If the risk assessment label of the target risk feature vector is different from the risk assessment result and the similarity is greater than or equal to the similarity threshold, the risk assessment result shall be adjusted and updated to the risk assessment label of the target risk feature vector.

[0104] The range of similarity threshold values ​​can be preset, for example, the range of similarity threshold values ​​is [0.75, 0.9], or the value of similarity threshold value is 0.8.

[0105] For example, if the risk assessment label of the target risk feature vector is the same as the risk assessment result, the risk assessment result is not adjusted.

[0106] In this embodiment, the generalization ability of the machine learning model can accurately assess rare authentication risks. Furthermore, by utilizing existing risk feature vectors in a risk feature library, the risk assessment results are constrained based on historical experience to correct prediction biases in the machine learning model's risk assessment results. This improves the accuracy and reliability of authentication and risk assessment.

[0107] In one possible embodiment, after step S130 or step S160, the authentication method further includes: if the risk assessment result indicates a first risk level, implementing a seamless pass strategy; if the risk assessment result indicates a second risk level, implementing a secondary verification strategy; if the risk assessment result indicates a third risk level, implementing a forced blocking strategy.

[0108] Seamless verification refers to a verification method that requires no user interaction. For example, a user can directly pass verification when making a regular money transfer using a frequently used device and IP address.

[0109] Two-factor authentication refers to adding an extra verification step on top of the initial verification. For example, a combination of SMS verification code and fingerprint verification.

[0110] A forced blocking strategy refers to suspending a transaction and triggering manual review. For example, when a user attempts to transfer a large sum of money from a different IP address, the server can forcibly block the transaction and send an alert.

[0111] In this embodiment, after generating the risk assessment result, the server can execute the corresponding authentication strategy according to the risk level indicated by the risk assessment result, dynamically adjusting the authentication strength to achieve a balance between improving authentication security and enhancing user experience. For example, if the risk assessment result indicates a first risk level, the user does not need additional verification, significantly shortening the verification time; if the risk assessment result indicates a second risk level, security is enhanced through secondary verification; if the risk assessment result indicates a third risk level, mandatory blocking ensures that suspicious transactions are intercepted immediately. Thus, the risk level-driven verification strategy avoids the cumbersome nature of static verification processes while improving the response efficiency to new authentication risks.

[0112] In one possible embodiment, the verification result can be obtained by executing a secondary verification strategy and a forced blocking strategy, and the server can send the verification result to the user terminal, the transaction system, and the account management system.

[0113] After the verification result is sent to the user terminal, the user terminal can be prompted with the current verification result, and the user terminal can also trigger and guide the user to perform subsequent operations based on the verification result.

[0114] After the verification results are sent to the trading system and the account management system, the trading system can determine whether to execute the transaction based on the verification results, and the account management system can execute account management operations based on the verification results.

[0115] If the verification result indicates that the user has failed the verification, the server can also send the verification result, along with the timestamp, user identifier, and other information, to the risk control center.

[0116] This enables the entire system, including user terminals, risk control centers, transaction systems, and account management systems, to perceive and process the verification results, ensuring risk control throughout the entire identity verification process.

[0117] In summary, the authentication method of this application embodiment has at least one of the following technical effects:

[0118] By extracting feature vectors from multimodal data and performing feature fusion, the limitations of traditional single-feature methods can be overcome, enabling the construction of a multi-dimensional risk assessment system and improving the accuracy of identity verification. Testing shows that the embodiments of this application achieve an identity verification accuracy rate that is more than 30% higher than that of single biometric features.

[0119] By dynamically implementing verification strategies based on risk levels, the user experience is optimized while ensuring identity verification security. Testing shows that the average identity verification time in this embodiment is reduced by 40%.

[0120] Machine learning models used for authentication and risk assessment may include one of the following: graph neural networks, gradient boosting trees, or transformer models, adapted to the specific scenarios of this application embodiment for automatic and accurate authentication and risk assessment. For example, graph neural networks can accurately capture associated risk features and have a higher ability to identify and assess complex risks. Gradient boosting trees, through multiple decision trees, can improve the predictive ability of risk assessment results and have stronger interpretability. In addition, gradient boosting trees are adaptable to heterogeneous features, and feature vectors of multimodal data do not require transformation processing, making them suitable for the feature vector scenarios of multimodal data in this application embodiment. Transformer models, through attention mechanisms, can capture risk features of higher importance in parallel, are suitable for processing high-dimensional features, and can alleviate the curse of dimensionality caused by high-dimensional features, making them suitable for the specific scenarios of high-dimensional feature vectors of multimodal data in this application embodiment.

[0121] By constructing a system architecture that combines user terminals and servers as edge nodes and a central node, overall performance can be improved. For example, extracting feature vectors from multimodal data through user terminals ensures real-time feature vector extraction, reduces the amount of data sent to the server and latency, and ensures the privacy of multimodal data. Deploying machine learning models on the server and performing the remaining steps, except for extracting feature vectors from multimodal data, can improve the server's processing efficiency.

[0122] Figure 4 This is a schematic diagram of the structure of the authentication device according to an embodiment of this application. Figure 4 As shown, the identity verification device provided in this application embodiment includes: a data acquisition module 210, a feature extraction module 220, and a risk assessment module 230.

[0123] The data acquisition module 210 is used to collect the user's multimodal data in response to the user's transaction triggering operation. The multimodal data includes biological data, behavioral data and environmental data.

[0124] The feature extraction module 220 is used to extract feature vectors from multimodal data.

[0125] The risk assessment module 230 is used to input the feature vectors of multimodal data into a machine learning model to generate risk assessment results that indicate the risk of user identity.

[0126] In one possible embodiment, the authentication device further includes: a preprocessing module, configured to perform the following preprocessing on the multimodal data and update the multimodal data using the preprocessed multimodal data: data cleaning of the multimodal data; alignment and normalization of the cleaned biological data; normalization and timestamp alignment of the cleaned behavioral data; and format standardization of the cleaned environmental data.

[0127] In one possible embodiment, the feature extraction module includes: a first feature extraction submodule for extracting features from biological data to obtain biological features, which include at least one of the following: facial features, voiceprint features, and fingerprint features; a second feature extraction submodule for extracting features from behavioral data to obtain behavioral features, which include at least one of the following: standard deviation of input speed, cluster center of click location, and quantile of page dwell time; a third feature extraction submodule for performing association label mapping processing on environmental data to obtain environmental features; and a feature fusion submodule for fusing biological features, behavioral features, and environmental features to obtain a feature vector of multimodal data.

[0128] In one possible embodiment, the risk assessment module includes one of the following: a first assessment submodule, used to convert the feature vectors of multimodal data into a graph structure, perform aggregation processing on the graph structure through a graph neural network, and predict the risk assessment result; a second assessment submodule, used to input the feature vectors of multimodal data into each decision tree of a gradient boosting tree, generate correction values, and generate risk assessment results based on the initial prediction values ​​and correction values; and a third assessment submodule, used to serialize the feature vectors of multimodal data, generate sequence vectors, perform attention processing on the sequence vectors through a transformer model, and predict the risk assessment result.

[0129] In one possible embodiment, the authentication device further includes: a similarity calculation module, used to calculate the similarity between the feature vector of the multimodal data and the risk feature vectors stored in the risk feature library; a target risk feature vector determination module, used to determine the target risk feature vector from the risk feature library based on the similarity; and an update module, used to adjust and update the risk assessment result to the risk assessment label of the target risk feature vector when the risk assessment label of the target risk feature vector is different from the risk assessment result and the similarity is greater than or equal to the similarity threshold.

[0130] In one possible embodiment, the authentication device further includes: an intervention module, configured to execute a seamless access strategy if the risk assessment result indicates a first risk level; execute a secondary verification strategy if the risk assessment result indicates a second risk level; and execute a forced blocking strategy if the risk assessment result indicates a third risk level.

[0131] In one possible embodiment, feature vectors of multimodal data are extracted and deployed on a user terminal. The user terminal extracts feature vectors of multimodal data through a lightweight model and sends the feature vectors of multimodal data to a server. The server then deploys a machine learning model.

[0132] In one possible embodiment, the lightweight model is obtained through one of the following processes: model pruning, quantization compression, and knowledge distillation.

[0133] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 5 As shown, this application embodiment provides an electronic device including a processor 301 and a memory 302. Optionally, the device further includes a communication component 303. The processor 301, memory 302, and communication component 303 are connected via a bus 304.

[0134] In the specific implementation process, the memory 302 stores code, and the processor 301 runs the code stored in the memory 302 to execute the method of the above method embodiment.

[0135] The specific implementation process of processor 301 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0136] In the above Figure 5 In the illustrated embodiments, it should be understood that the processor 301 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0137] The memory 302 may include high-speed RAM memory, and may also include non-volatile memory (NVM), such as at least one disk storage.

[0138] Bus 304 can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Bus 304 can be divided into address bus, data bus, control bus, etc. For ease of illustration, the bus 304 in the accompanying drawings of this application is not limited to only one bus or one type of bus.

[0139] This application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods described in the above-described method embodiments.

[0140] The aforementioned computer-readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0141] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0142] This application provides a computer program product, including a computer program that, when executed by a processor, implements the methods provided in any of the embodiments described above.

[0143] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.

[0144] It should be further noted that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0145] It should be understood that the above-described device embodiments are merely illustrative, and the device of this application can also be implemented in other ways. For example, the division of units / modules in the above embodiments is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units, modules, or components may be combined, or integrated into another system, or some features may be ignored or not executed.

[0146] Furthermore, unless otherwise specified, the functional units / modules in the various embodiments of this application can be integrated into one unit / module, or each unit / module can exist physically separately, or two or more units / modules can be integrated together. The integrated units / modules described above can be implemented in hardware or as software program modules.

[0147] When integrated units / modules are implemented in hardware, the hardware can be digital circuits, analog circuits, etc. The physical implementation of the hardware structure includes, but is not limited to, transistors, memristors, etc. Unless otherwise specified, the processor can be any suitable hardware processor, such as a CPU, GPU, FPGA, DSP, and ASIC, etc. Unless otherwise specified, the storage unit can be any suitable magnetic or magneto-optical storage medium, such as Resistive Random Access Memory (RRAM), Dynamic Random Access Memory (DRAM), Static Random Access Memory (SRAM), Enhanced Dynamic Random Access Memory (EDRAM), High-Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), etc.

[0148] If the integrated unit / module is implemented as a software program module and sold or used as an independent financial product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software financial product. This computer software financial product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0149] In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0150] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0151] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. An authentication method, characterized in that, include: In response to a user triggering a transaction, the system collects the user's multimodal data, which includes biological data, behavioral data, and environmental data. Extract the feature vectors from the multimodal data; The feature vectors of the multimodal data are input into a machine learning model to generate risk assessment results that indicate the risk of user identity.

2. The method according to claim 1, characterized in that, Before extracting the feature vectors from the multimodal data, the method further includes: performing the following preprocessing on the multimodal data, and updating the multimodal data using the preprocessed multimodal data: The multimodal data is cleaned. The cleaned biological data is then aligned and normalized. Normalize and align the cleaned behavioral data with timestamps. The environmental data after cleaning is standardized in format.

3. The method according to claim 1 or 2, characterized in that, The extraction of feature vectors from the multimodal data includes: The biological data is subjected to feature extraction to obtain biological features, which include at least one of the following: facial features, voiceprint features, and fingerprint features. Feature extraction is performed on the behavioral data to obtain behavioral features, which include at least one of the following: standard deviation of input speed, cluster center of click location, and quantile of page dwell time; The environmental data is subjected to associated label mapping processing to obtain environmental features; The biological characteristics, behavioral characteristics, and environmental characteristics are fused to obtain the feature vector of the multimodal data.

4. The method according to claim 3, characterized in that, The step of inputting the feature vectors of the multimodal data into a machine learning model to generate a risk assessment result indicating user identity risk includes one of the following: The feature vectors of the multimodal data are converted into a graph structure, and the graph structure is aggregated and processed by a graph neural network to predict the risk assessment results. The feature vectors of the multimodal data are input into each decision tree of the gradient boosting tree to generate correction values ​​and generate the risk assessment results based on the initial prediction values ​​and the correction values. The feature vectors of the multimodal data are serialized to generate sequence vectors, and attention processing is performed on the sequence vectors using a transformer model to predict the risk assessment results.

5. The method according to claim 4, characterized in that, After generating the risk assessment result indicating the risk to the user's identity, the method further includes: The similarity between the feature vectors of the multimodal data and the existing risk feature vectors in the risk feature database is calculated. The target risk feature vector is determined from the risk feature library based on the similarity. If the risk assessment label of the target risk feature vector is different from the risk assessment result and the similarity is greater than or equal to the similarity threshold, the risk assessment result is adjusted and updated to the risk assessment label of the target risk feature vector.

6. The method according to claim 5, characterized in that, After generating the risk assessment result indicating the risk to the user's identity, the method further includes: If the risk assessment result indicates the first risk level, implement the seamless passage strategy; If the risk assessment result indicates a second risk level, a secondary verification strategy shall be implemented. If the risk assessment results indicate a level 3 risk, a mandatory blocking strategy will be implemented.

7. The method according to claim 1 or 2, characterized in that, The feature vectors of the extracted multimodal data are deployed on the user terminal. The user terminal extracts the feature vectors of the multimodal data through a lightweight model and sends the feature vectors of the multimodal data to the server. The server deploys the machine learning model.

8. The method according to claim 7, characterized in that, The lightweight model is obtained through one of the following processes: model pruning, quantization compression, and knowledge distillation.

9. An identity verification device, characterized in that, include: The data acquisition module is used to collect the user's multimodal data in response to the user's transaction triggering operation. The multimodal data includes biological data, behavioral data, and environmental data. The feature extraction module is used to extract the feature vectors of the multimodal data; The risk assessment module is used to input the feature vectors of the multimodal data into a machine learning model to generate risk assessment results that indicate the risk of user identity.

10. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 8.

12. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 8.

Images