A multi-factor identity authentication-based real-time behavior monitoring system for a secret-related terminal

Abstract

The application discloses a kind of real-time behavior supervision systems of secret-related terminal based on multi-factor identity authentication, and relates to the field of information security technology.The real-time behavior supervision systems of secret-related terminal based on multi-factor identity authentication, including identity authentication unit, terminal probe unit, attack and theft of secrets traceability analysis unit and behavior supervision correlation analysis unit, the system is through collecting terminal identity, environment, process and network connection log, and with network side attack alarm space-time correlation analysis, can when discovering network attack behavior, quickly locate to specific secret-related terminal and its operation user, and correlation analysis attack occurs before terminal physical environment state, generate high-risk event alarm of fusion multi-party evidence, the present application is through the multi-factor authentication of secret-related terminal, real-time behavior monitoring and network attack detection depth correlation, solved the difficult problem of terminal security and network security data split, realized from network attack alarm to specific person in charge and the accurate traceability of on-site environment evidence.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a real-time behavior monitoring system for classified terminals based on multi-factor authentication. Background Technology

[0002] Security systems for classified terminals typically consist of multiple layers of technology. At the level of physical access to the terminal and operator authentication, a common solution is to deploy a separate identity authentication system. These systems combine biometric recognition (such as facial recognition) with hardware tokens (such as USB keys) and other multi-factor authentication methods to achieve strong user authentication during login. During use, sensors can monitor the environment in front of the terminal, providing warnings and locking the screen for obvious risks such as leaving the seat, peeping, and unauthorized photography. At the level of network boundary and traffic monitoring, network threat detection and attribution systems are usually deployed independently. These systems collect and deeply analyze all network outbound traffic, utilizing threat intelligence databases and detection models to promptly detect attacks and data theft originating from the internet or internal networks, such as scanning, penetration, and data leakage, and generate corresponding security event alerts. Currently, both of these technologies play important roles in their respective fields, together forming a comprehensive security protection system.

[0003] The limitations of existing technologies include at least the following problems: In the security supervision of classified terminals, existing technologies have the limitation of disconnecting terminal behavior monitoring and network attack detection. For example, when the network side detects data theft attack traffic originating from within, due to the lack of effective correlation with real-time terminal behavior data, it is difficult to quickly determine which physical terminal the attack originated from, which logged-in user actually performed the operation, and it is also difficult to determine whether there was a high-risk environment such as someone else spying on the screen or using a camera device in front of the terminal when the attack occurred. As a result, the security response remains at the network level, making it difficult to accurately locate and promptly deal with the source terminal and responsible person. This not only prolongs the incident investigation and containment cycle, but also makes it difficult to effectively detect and block covert data theft behaviors in cases of internal collusion or user identity theft. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a real-time behavior monitoring system for classified terminals based on multi-factor authentication. This system solves the problems in existing technologies where terminal behavior monitoring and network attack detection are disconnected, making it difficult to quickly and accurately locate the source terminal and responsible person for leaks and take immediate action.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a real-time behavior monitoring system for classified terminals based on multi-factor authentication, comprising: an identity authentication unit, used to perform multi-factor authentication on users through an intelligent sensing module and a USB key, and continuously monitor the environment in front of the terminal after successful authentication; when a second face, a camera device, or the authenticated user not looking at the screen is detected, an environmental alarm log is generated and uploaded; a terminal probe unit, used to collect process information and network connection logs of the classified terminal, the network connection logs including the IP address of the classified terminal, the destination address of the connection, and the connection time; an attack and theft source analysis unit, used to store and monitor full network traffic, detect attack and theft behaviors based on threat intelligence, and generate network attack alarm logs including event time, source address, destination address, and attack characteristics; and a behavior monitoring correlation analysis unit. It is communicatively connected to the identity authentication unit, the terminal probe unit, and the attack and data theft tracing analysis unit, and is used for: receiving environmental alarm logs and corresponding user identity information uploaded by the identity authentication unit; receiving network connection logs uploaded by the terminal probe unit; receiving network attack alarm logs generated by the attack and data theft tracing analysis unit; associating network attack alarm logs with network connection logs, specifically including: searching for connection records with the same destination address and time matching in the network connection log based on the destination address and event time in the network attack alarm log to determine the target classified terminal that sent the network attack traffic; associating the environmental alarm logs and user identity information generated by the identity authentication unit for the target classified terminal before and after the event time; and generating and outputting high-risk event alarm information when the association result indicates that the target classified terminal has environmental alarms before and after the event time.

[0006] Furthermore, multi-factor authentication of users is performed through the intelligent sensing module and USB key, specifically including: acquiring facial images and extracting features through the intelligent sensing module; reading hardware certificate information through the USB key; using a confidence fusion algorithm to make a fusion decision on the extracted facial features and the read hardware certificate information; and determining that the identity authentication is successful when the fusion decision result exceeds a preset threshold.

[0007] Furthermore, the rules for dynamically adjusting the weights in the confidence fusion algorithm include: when the illumination uniformity of the face image collected by the intelligent sensing module is lower than the illumination threshold, the fusion weight of the face feature confidence is reduced; when the USBkey hardware certificate information is read normally but the number of consecutive authentication failures of the dynamic token reaches the failure threshold, the fusion weight of the hardware authentication factor is reduced.

[0008] Furthermore, continuous monitoring of the environment in front of the terminal and identification of violations are carried out, specifically including: real-time target detection of the video stream collected by the intelligent perception module through a pre-trained lightweight convolutional neural network model; when the model outputs a detection confidence score for the second face or the shooting device category that exceeds the corresponding category threshold, it is determined that there is a corresponding violation.

[0009] Furthermore, network connection logs are collected, specifically including: collecting the five-tuple information of the network connection; collecting the process name, process hash value, and parent process information corresponding to the network connection; and collecting the traffic volume and number of data packets of the network connection within the sampling period.

[0010] Furthermore, the network attack alarm logs are correlated with the network connection logs, specifically including: defining a correlation time window based on the event time in the network attack alarm logs; searching for records in the network connection logs whose destination addresses match and whose connection times fall within the correlation time window; and identifying the classified terminal to which the source IP address of the matching record belongs as the target classified terminal.

[0011] Furthermore, the environmental alarm logs and user identity information of the target classified terminal are associated, specifically including: defining a traceability time window wider than the associated time window based on the event time in the network attack alarm log; extracting all environmental alarm logs of the target classified terminal within the traceability time window; classifying the extracted environmental alarm logs by type, and weighting and accumulating them according to the basic risk value of each type of alarm and the proximity of the occurrence time to generate an environmental behavior risk score.

[0012] Furthermore, the rules for generating high-risk event alarm information are as follows: when the environmental behavior risk score exceeds the risk threshold, a high-risk event alarm information is generated; the content structure of the high-risk event alarm information is dynamically adjusted according to the main environmental alarm types.

[0013] Furthermore, high-risk event alarm information is generated and output, specifically including: aggregating network attack alarm logs, network connection logs and corresponding process details of the target classified terminal, environmental alarm log snapshots of the target classified terminal, and user identity information into a traceability evidence chain in chronological order; the traceability evidence chain is displayed in a timeline view and supports drill-down to view the associated original network traffic data packet fragments.

[0014] Furthermore, after generating high-risk event alarm information, the system automatically executes linkage response instructions, which specifically include: sending a screen lock instruction to the identity authentication unit of the target classified terminal to trigger immediate screen lock; and sending a policy instruction to the network-side firewall or switch to block subsequent communication between the target classified terminal and the destination address in the network attack alarm log.

[0015] The present invention has the following beneficial effects:

[0016] (1) This real-time behavior monitoring system for classified terminals based on multi-factor authentication deeply correlates the terminal user behavior and environmental alarm logs collected by the identity authentication unit with the network attack alarms generated by the attack and theft source analysis unit. This breaks the traditional situation where terminal monitoring and network monitoring are independent of each other. In the traditional way, network devices can only locate the IP address when they discover attack traffic. Security administrators need to manually cross-query in multiple scattered log systems to slowly correlate the specific physical terminal and the operating user. This is inefficient and easy to miss. This system automatically matches the terminal network logs reported by the terminal probe unit that initiated the connection to the same address at the same time point based on the destination address and time point in the network attack alarm through the behavior monitoring correlation analysis unit. This allows the virtual network attack event to be quickly anchored to the specific classified terminal that sent the traffic. This process changes the previous dilemma of relying on manual splicing of clues for security event analysis. It builds the ability to trace the network attack directly to the responsible terminal. This enables the theft of secrets initiated against the internal to be quickly discovered and located, greatly compressing the attacker's hiding space and providing a clear target for subsequent accurate handling.

[0017] (2) This real-time behavior monitoring system for classified terminals based on multi-factor authentication introduces a dynamic weight adjustment mechanism based on factors such as ambient light and hardware token status in the multi-factor authentication process, and applies a lightweight detection model optimized for office scenarios in environmental monitoring. This constructs a more intelligent and robust active defense layer on the terminal side. Once the traditional static authentication method is passed, it loses control over subsequent user behavior. However, after successful authentication, the intelligent perception module of the identity authentication unit in this system continues to work and can identify abnormal environments such as a second person peeping at the screen or taking pictures with a mobile phone in real time. This effectively prevents the risk of leakage of information in cases of authorized users operating illegally or being coerced. At the same time, the dynamic adjustment mechanism of authentication weight avoids the failure of the entire authentication due to a single authentication factor, such as the failure of face recognition under strong backlight, or temporary fluctuations. Under the premise of ensuring security strength, it improves the user experience and authentication success rate of legitimate users in complex real office environments.

[0018] (3) The real-time behavior monitoring system for classified terminals based on multi-factor authentication establishes a complete closed loop from risk quantification assessment to automated handling, transforming security warnings into actionable actions, which significantly improves the response and handling efficiency of security incidents. The system classifies and weights all environmental alarms of the target terminal during the attack period through correlation analysis, generating a quantitative environmental behavior risk score. Based on this score and preset threshold, the system automatically determines the risk level and generates a complete traceability evidence chain that integrates network attack characteristics, terminal information, user identity and environmental snapshots. This evidence chain not only presents the whole picture of the event in an intuitive timeline view, but also triggers automated linkage handling instructions: on the one hand, it sends a screen lock instruction to the terminal involved to immediately interrupt possible continuous leakage operations; on the other hand, it issues a policy to the network device to block the subsequent communication between the terminal and the malicious destination. This series of actions are completed automatically in a very short time, realizing full automation from risk perception, analysis and judgment to control and blocking.

[0019] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0020] Figure 1 This is a block diagram of a real-time behavior monitoring system for classified terminals based on multi-factor authentication, according to the present invention.

[0021] Figure 2 This is a flowchart illustrating the specific steps involved in continuously monitoring the environment in front of a terminal and identifying violations in a real-time behavior monitoring system for classified terminals based on multi-factor authentication, as described in this invention.

[0022] Figure 3 This is a flowchart illustrating the specific steps involved in automatically executing coordinated response commands after generating high-risk event alarm information in a real-time behavior monitoring system for classified terminals based on multi-factor authentication, as described in this invention. Detailed Implementation

[0023] Please see Figure 1This invention provides a technical solution: a real-time behavior monitoring system for classified terminals based on multi-factor authentication, comprising: an identity authentication unit deployed on the classified terminal, used to perform multi-factor authentication on users through an intelligent sensing module and a USB key, and continuously monitor the environment in front of the terminal after successful authentication; when a second face, a camera device, or the authenticated user not looking at the screen is detected, an environmental alarm log is generated and uploaded; a terminal probe unit deployed on the classified terminal, used to collect process information and network connection logs of the classified terminal, the network connection logs including the IP address of the classified terminal, the destination address of the connection, and the connection time; and an attack and espionage source analysis unit, used to store and monitor full network traffic, detect attack and espionage behavior based on threat intelligence, and generate data including event time, source address, and destination address. The system includes network attack alarm logs and attack characteristics; a behavior monitoring and correlation analysis unit, which is communicatively connected to the identity authentication unit, terminal probe unit, and attack and data theft tracing analysis unit, and is used to: receive environmental alarm logs and corresponding user identity information uploaded by the identity authentication unit; receive network connection logs uploaded by the terminal probe unit; receive network attack alarm logs generated by the attack and data theft tracing analysis unit; and correlate network attack alarm logs with network connection logs, specifically including: searching for connection records with the same destination address and time matching in the network connection log based on the destination address and event time in the network attack alarm log to determine the target classified terminal that sent the network attack traffic; and correlating the environmental alarm logs and user identity information generated by the identity authentication unit before and after the event time of the target classified terminal.

[0024] When the correlation results indicate that the target classified terminal has environmental alarms before and after the event time, a high-risk event alarm information that integrates network attack characteristics, terminal identifier, corresponding user identity and on-site environmental status is generated and output.

[0025] Among them, the preset threshold, illumination threshold, failure threshold, associated time window, traceability time window, risk threshold, and thresholds for each category are all configured and updated by the system administrator through the management interface of the behavior supervision and correlation analysis unit.

[0026] Specifically, multi-factor authentication of users is performed through an intelligent sensing module and a USB key, including:

[0027] The intelligent sensing module collects facial images and extracts features, specifically as follows:

[0028] The intelligent sensing module acquires RGB images at a rate of 30 frames per second. Near-infrared images ;

[0029] After performing face detection and alignment on the images, a lightweight convolutional neural network pre-trained on the VGGFace2 dataset is used. Extracting 128-dimensional facial feature vectors ;

[0030] The hardware certificate information is read via the USB key, specifically as follows:

[0031] The USBkey internally stores a public-private key pair generated by the SM2 elliptic curve digital signature algorithm. When the USBkey is inserted into a terminal, the authentication unit sends a random challenge to the USBkey. The USBkey uses its private key sk to sign the challenge sig=Sign. sk (challenge) and return, while reading the user's unique identifier UID stored in the USBkey;

[0032] A confidence fusion algorithm is used to make a fusion decision between the extracted facial features and the read hardware certificate information. Specifically:

[0033] First, calculate facial features and pre-registration templates. Cosine similarity as confidence level Verify the USB key signature and confirm that the UID is in the authorized list, obtaining a boolean result "valid".

[0034] If successful, set the hardware certificate confidence level. =1.0, otherwise =0;

[0035] Fusion using weighted average ,in and For the corresponding weights, In this embodiment, the initial values ​​are set to 0.4 and 0.6 respectively;

[0036] When the fusion decision result exceeds a preset threshold, the identity authentication is deemed successful, specifically as follows:

[0037] Preset threshold Set to 0.75, if If the authentication passes, the authentication is successful; otherwise, the authentication fails and is logged.

[0038] The pre-training steps for the lightweight convolutional neural network (used for facial feature extraction) are as follows:

[0039] The dataset is preprocessed, including detecting and aligning face regions in each image, scaling them uniformly to 224×224 pixels, and normalizing them.

[0040] The model architecture uses MobileNetV2 pre-trained on ImageNet as the backbone network, removes its top classification layer and replaces it with a global average pooling layer and a fully connected layer with an output dimension of 128 to generate face feature vectors.

[0041] The training objective uses a triplet loss function, which aims to make different image features of the same individual as close as possible in the embedding space, while keeping the features of different individuals as far apart as possible.

[0042] Training was performed using a stochastic gradient descent optimizer with an initial learning rate of 0.001, a batch size of 64, and a total of 50 training epochs.

[0043] During training, an online hard example mining strategy is adopted to dynamically select the most representative hard triplets in each batch for calculation in order to improve the model's discriminative power.

[0044] After training, the model performance was evaluated on standard face verification benchmark sets such as LFW to ensure that its accuracy exceeded 99%, and then the model parameters were saved.

[0045] The rules for dynamically adjusting weights in the confidence fusion algorithm include:

[0046] When the illumination uniformity of the face image acquired by the intelligent perception module is lower than the illumination threshold, the fusion weight of the face feature confidence is reduced, specifically as follows:

[0047] Illumination uniformity is calculated from the image. grayscale image Standard deviation To evaluate;

[0048] like (in =30), then the illumination uniformity is considered low, and in this case... Temporarily adjusted to ,at the same time ;

[0049] When the USBkey hardware certificate information is read normally but the number of consecutive authentication failures of the dynamic token reaches the failure threshold, the fusion weight of the hardware authentication factor is reduced, specifically as follows:

[0050] Let the dynamic token consecutive failure counter be... Failure threshold =3;

[0051] like Then Adjusted to ,at the same time .

[0052] In this implementation scheme, multi-factor authentication is achieved by integrating facial biometrics with hardware certificates based on national cryptographic algorithms, thus building a more robust foundation for identity verification. The dynamic weight adjustment mechanism demonstrates the design's intelligent adaptability: when poor lighting affects facial recognition quality, the system automatically reduces the weight of that factor to prevent overall authentication failure due to environmental interference in a single period, ensuring smooth use by legitimate users in complex real-world scenarios; when the hardware token experiences continuous anomalies, its weight is lowered to prevent potential impersonation risks. This dynamic trade-off strategy based on real-time conditions ensures that the system neither rigidly blocks legitimate access due to localized problems nor fails to maintain a high standard of trust assessment, thus achieving an effective balance between ensuring authentication strength and improving user experience, enhancing the robustness of the entire system in actual deployment.

[0053] Specifically, such as Figure 2 As shown, continuous monitoring of the environment in front of the terminal and identification of violations are implemented, specifically including:

[0054] A pre-trained lightweight convolutional neural network model is used to perform real-time object detection on the video stream acquired by the intelligent perception module. Specifically:

[0055] The lightweight convolutional neural network model uses the YOLOv5s architecture, and its pre-training steps are as follows:

[0056] The pre-training steps for a lightweight convolutional neural network (YOLOv5s) are as follows:

[0057] We collected and labeled a large number of images from office environments, including three categories: "second face", "mobile phone", and "camera", to ensure that all relevant targets in each image were accurately labeled with bounding boxes.

[0058] The dataset was divided into training, validation, and test sets in an 8:1:1 ratio.

[0059] It adopts the open-source architecture of YOLOv5s, and uses Mosaic data augmentation on its input side to randomly scale, crop and stitch images to improve the model's robustness to small objects and complex backgrounds;

[0060] The backbone network uses CSPDarknet, and the neck network uses PANet structure to enhance feature fusion;

[0061] During training, a stochastic gradient descent optimizer was used with a momentum of 0.937 and a weight decay factor of 0.0005.

[0062] The initial learning rate was set to 0.01, and a cosine annealing scheduling strategy was used to dynamically adjust it during training.

[0063] The model was trained on the training set for a total of 300 epochs with a batch size of 16.

[0064] During training, the mean accuracy metric is continuously monitored on the validation set, and the best model is saved.

[0065] The model performance was evaluated on a separate test set to ensure that the average accuracy for both the "second face" and "shooting device" categories exceeded 90%.

[0066] The dataset is trained on a self-built dataset of prohibited objects in an office setting (including three categories of annotations: "second face", "mobile phone", and "camera"). The input image size is 640×640, and the output bounding box B=(x,y,w,h) and class confidence are given. ;

[0067] When the model outputs a detection confidence score for the second face or the shooting device category that exceeds the corresponding category threshold, a violation is determined to have occurred, specifically:

[0068] Set a category threshold for the second face. =0.85, threshold for the category of shooting equipment =0.90;

[0069] If any detection box satisfies ≥ If the category is "second face", then a second face is determined to exist.

[0070] If any detection box satisfies ≥ If the category is "mobile phone" or "camera", then it is determined that a shooting device exists;

[0071] To determine if the user is not looking at the screen, the angle between the gaze direction vector d and the screen normal vector n is calculated using a head pose estimation network based on Hopenet. ,like (in =30°) lasting longer than =5 seconds, then it is determined that the user is not looking at the screen.

[0072] In this implementation plan, a lightweight detection model specifically optimized for office scenarios is used to achieve accurate and real-time identification of violations in front of the terminal. This model is trained based on real office environment data and can effectively distinguish between a second face and devices such as mobile phone cameras, improving the targeting and reliability of monitoring. Combined with head posture estimation technology, the system can intelligently determine whether the user's attention is off the screen, avoiding misjudgments caused by brief unintentional actions. The lightweight design ensures stable operation under the limited computing power of confidential terminals, continuously protecting the operating environment in a non-contact manner, effectively identifying risks such as screen peeping, unauthorized filming, and distracted operation, and providing clear and reliable on-site judgment basis for subsequent security response.

[0073] Specifically, network connection logs are collected, including:

[0074] The five-tuple information of network connections is collected, specifically as follows:

[0075] The 5-tuple includes the source IP address Destination IP address Source port Destination port Transport layer protocols (proto, such as TCP and UDP);

[0076] The process name, process hash value, and parent process information corresponding to the network connection are collected, specifically as follows:

[0077] By hooking system calls (such as TDI / NDIS on Windows, netlink on Linux), the process ID (PID) corresponding to each socket can be obtained, and then process information, including the process name, can be queried. SHA-256 hash value of the executable file of the process Parent process ID (PPID) and parent process name ;

[0078] The data collection process involves analyzing the network traffic volume and data packet count during the sampling period. Specifically:

[0079] Set the sampling period Δt = 5 seconds, and record the number of uplink bytes for this connection within this period. Downlink byte count Uplink data packet count Downlink data packet count .

[0080] In this implementation plan, multi-dimensional and fine-grained data collection of terminal network connections lays a solid data foundation for subsequent accurate correlation analysis. It not only records the five-tuple information of communication to depict the network session profile, but more importantly, it uses system call hooking technology to strongly associate each network connection with the specific process that issued the connection, its executable file hash, and parent process information. This allows abstract traffic to be traced back to specific applications and their startup sources. At the same time, the periodic traffic size and packet quantity statistics provide quantitative evidence for identifying abnormal data transmission behavior. This collection method goes beyond simple recording of IP addresses, thus effectively supporting the tracing from network layer alarms to specific application behavior and users at the terminal layer when network attack alarms occur.

[0081] Specifically, the network attack alert logs are correlated with the network connection logs, including:

[0082] Based on the event time in the network attack alert log, a relevant time window is defined, specifically as follows:

[0083] Set the alarm event time as The associated time window is ,in =2 minutes;

[0084] In the network connection log, search for records where the destination address matches and the connection time falls within the associated time window. Specifically:

[0085] For each network attack alert, extract its destination address. and destination port ;

[0086] Search the network connection log for matching conditions. The records, among which For connection time;

[0087] The classified terminal to which the source IP address of the matched record belongs is identified as the target classified terminal, specifically as follows:

[0088] Extract the source IP address from the matched network connection records. By using the binding table between IP addresses and terminal identifiers, the corresponding classified terminal identifier can be determined. .

[0089] The associated environmental alarm logs and user identity information of the classified terminal are specifically included in:

[0090] Based on the event time in the network attack alert log, a traceability time window wider than the associated time window is defined, specifically as follows:

[0091] The time window for tracing back is ,in =10 minutes, and ;

[0092] Within the traceback time window, extract all environmental alarm logs of the target classified terminal, specifically:

[0093] According to terminal identifier Query the environmental alarm log database to find the condition that meets the requirements. All records, of which For environmental alarm time;

[0094] The extracted environmental alarm logs are categorized by type, and weighted and accumulated based on the basic risk value of each type of alarm and the proximity of their occurrence time to generate an environmental behavior risk score, which is as follows:

[0095] Let the extracted environmental alarm log set be Each alarm Has type ∈{face, device, gaze} and time of occurrence Environmental behavior risk score ,in Basic risk value, Environmental behavior risk score with time decay weighting In the calculation, the basic risk value Configure alarm type as follows:

[0096] The existence of a second face =8, there is a camera. =6, User is not looking at the screen. =3;

[0097] The time decay function is ,in The time of the cyberattack incident. This is the attenuation coefficient, with a default value of 0.1.

[0098] The rules for generating high-risk event alarm information are as follows:

[0099] When the environmental behavior risk score exceeds the risk threshold, a high-risk event alarm message is generated, specifically as follows:

[0100] Risk threshold =15, if If so, the high-risk event alarm generation process will be triggered;

[0101] The content structure of high-risk event alarm information is dynamically adjusted based on the main environmental alarm types, specifically as follows:

[0102] like Primarily contributed by second-person face alerts (i.e. If the alarm title is set to "High Risk: Screen peeping occurred during the cyberattack";

[0103] If the alarms are mainly contributed by the camera equipment, then the title should be set to "High Risk: Camera activity occurred during the cyberattack";

[0104] Otherwise, set the title to "High Risk: Abnormal Endpoint Environment During Cyber ​​Attack".

[0105] In this implementation plan, precise time and address matching reliably correlates attack events captured by the network side with network connections initiated by the terminal side, thereby pinpointing the source terminal. Furthermore, instead of simply listing terminal environmental alarms, the system introduces a scoring model that comprehensively considers the inherent risk of alarm types and temporal proximity. This transforms the fuzzy judgment of "whether there is an environmental anomaly" into a specific, quantifiable risk score. This allows security administrators to quickly determine the risk level of the terminal's on-site environment at the time of the attack based on objective threshold standards rather than subjective experience. Finally, the system intelligently generates semantically clear alarm titles based on the scoring results, significantly reducing the understanding cost and decision-making time for event analysis.

[0106] Specifically, it generates and outputs high-risk event alarm information, including:

[0107] The network attack alert logs, network connection logs and corresponding process details of the target classified terminal, environmental alert log snapshots of the target classified terminal, and user identity information are aggregated in chronological order to form a chain of evidence for tracing the source. Specifically, it is as follows:

[0108] The traceability evidence chain is a JSON data structure containing the fields alert_time, attack_details, terminal_id, terminal_ip, user_identity, network_connections (an array, each element containing connection details and corresponding process information), and environment_alerts (an array, each element containing alarm type, time, and Base64 encoded snapshot image).

[0109] The chain of evidence is displayed in a timeline view and supports drill-down to view related original network traffic packet fragments, specifically:

[0110] In the front-end interface of the behavior monitoring and correlation analysis unit, a timeline drawing component based on HTML5Canvas is used. The horizontal axis represents time, and the vertical axis represents event type (network attack, network connection, environmental alarm). Each event is marked with an icon. Clicking the network attack event icon allows you to drill down to view the corresponding original traffic data packet fragments provided by the attack and data theft tracing analysis unit (available for download in PCAP format).

[0111] In this implementation plan, by aggregating multi-source heterogeneous security data into a standardized traceability evidence chain according to the timeline and using a graphical timeline for intuitive display, it fundamentally changes the analysis and presentation methods of security events. Information such as discrete network attack details, terminal connection processes, on-site environment snapshots, and user identities is integrated into structured data objects. This not only ensures the centralized retention and traceability of all key evidence, but also visualizes the complex event context in a clear and straightforward manner through the timeline view, enabling security analysts to quickly grasp the complete context before and after the attack. Particularly crucial is that by supporting drilling down to the original network packets, this design provides a directly verifiable underlying data interface for advanced analysis or forensic evidence collection, integrating efficient event judgment and in-depth evidence investigation capabilities.

[0112] Specifically, as Figure 3 shown, after generating the high-risk event warning information, the linkage disposal instructions are automatically executed, specifically including:

[0113] Send a lock screen instruction to the identity authentication unit of the target confidential terminal to trigger immediate locking of the screen. Specifically:

[0114] The lock screen instruction is sent through an encrypted WebSocket connection, and the instruction format is {"command":"lock_screen","terminal_id":"xxx","timestamp":"xxx","signature":"xxx"}. After receiving it, the identity authentication unit verifies the signature and calls the operating system lock screen API;

[0115] Send a policy instruction to the network-side firewall or switch to block subsequent communications between the target confidential terminal and the destination address in the network attack warning log. Specifically:

[0116] Call the firewall management interface through RESTAPI to issue a dynamic ACL policy. The policy rule is to deny the source IP from accessing the destination and the destination port , the policy takes effect immediately, and the expiration time is 24 hours later.

[0117] In this implementation plan, through a pre-set automated linkage disposal mechanism, after confirming a high-risk event, coordinated control actions at the terminal and network levels can be immediately executed. This process does not require waiting for manual analysis and decision-making intervention. The system will issue a lock screen instruction to the involved terminal via an encrypted channel, directly interrupting any improper operations that may be in progress. At the same time, a temporary access control policy is pushed to the network device through a standard interface to immediately cut off the communication path between this terminal and the malicious target. This automated closed-loop disposal minimizes the delay of security response and effectively controls the spread window of potential hazards.

[0118] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0119] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A real-time behavior monitoring system for classified terminals based on multi-factor authentication, characterized in that, include: The identity authentication unit is used to perform multi-factor authentication for users. After successful authentication, it continuously monitors the environment in front of the terminal. When a violation is detected, it generates and uploads an environment alarm log. The terminal probe unit is used to collect process information and network connection logs of classified terminals. The network connection logs include the IP address of the classified terminal, the destination address of the connection, and the connection time. The attack and data theft tracing and analysis unit is used to store and monitor all network traffic, detect attack and data theft behaviors based on threat intelligence, and generate network attack alarm logs containing event time, source address, destination address and attack characteristics. The behavior monitoring correlation analysis unit is used to correlate network attack alarm logs with network connection logs, specifically including: Based on the destination address and event time in the network attack alarm log, search for connection records with the same destination address and matching time in the network connection log to determine the target classified terminal that sent the network attack traffic. The system associates the target classified terminal with environmental alarm logs and user identity information before and after the event time, and generates and outputs high-risk event alarm information when environmental alarms exist. Linking network attack alert logs with network connection logs specifically includes: Delineate the relevant time window based on the event time in the network attack alarm log; In the network connection log, find records where the destination address matches and the connection time falls within the associated time window; The classified terminal to which the source IP address of the matched record belongs is identified as the target classified terminal; The associated environmental alarm logs and user identity information of the classified terminal are specifically included in: Based on the event time in the network attack alarm log, define a traceability time window that is wider than the associated time window; Within the traceback time window, extract all environmental alarm logs of the target classified terminal; The extracted environmental alarm logs are categorized by type, and weighted and accumulated based on the basic risk value of each type of alarm and the proximity of their occurrence time to generate an environmental behavior risk score. The rules for generating high-risk event alarm information are as follows: When the environmental behavior risk score exceeds the risk threshold, a high-risk event alarm message is generated; The content structure of high-risk event alarm information is dynamically adjusted based on the main environmental alarm types; Generate and output high-risk event alarm information, specifically including: The network attack alarm logs, network connection logs and corresponding process details of the target classified terminal, environmental alarm log snapshots of the target classified terminal, and user identity information are aggregated into a chain of evidence for tracing the source in chronological order. The chain of evidence is displayed in a timeline view and supports drill-down to view related original network traffic packet fragments.

2. The real-time behavior monitoring system for classified terminals based on multi-factor authentication according to claim 1, characterized in that, Multi-factor authentication for users specifically includes: The intelligent sensing module collects facial images and extracts features. Read hardware certificate information via USBkey; A confidence fusion algorithm is used to make a decision by fusing the extracted facial features with the read hardware certificate information; When the fusion decision result exceeds the preset threshold, the identity authentication is deemed successful.

3. The real-time behavior monitoring system for classified terminals based on multi-factor authentication according to claim 2, characterized in that, The rules for dynamically adjusting weights in the confidence fusion algorithm include: When the illumination uniformity of the face image collected by the intelligent perception module is lower than the illumination threshold, the fusion weight of the face feature confidence is reduced. When the USBkey hardware certificate information is read normally but the number of consecutive authentication failures of the dynamic token reaches the failure threshold, the fusion weight of the hardware authentication factor is reduced.

4. The real-time behavior monitoring system for classified terminals based on multi-factor authentication according to claim 1, characterized in that, Continuously monitor the environment in front of the terminal and identify violations, specifically including: Real-time target detection is performed on the video stream acquired by the intelligent perception module using a pre-trained lightweight convolutional neural network model. When the model outputs a detection confidence score for a second face or a camera device category that exceeds the corresponding category threshold, it is determined that there is a violation.

5. The real-time behavior monitoring system for classified terminals based on multi-factor authentication according to claim 1, characterized in that, Collect network connection logs, specifically including: Collect the five-tuple information of network connections; Collect the process name, process hash value, and parent process information corresponding to the network connection; Collect the network traffic volume and number of data packets during the sampling period.

6. The real-time behavior monitoring system for classified terminals based on multi-factor authentication according to claim 1, characterized in that, After generating a high-risk event alarm, the system automatically executes coordinated response instructions, including: Send a screen lock command to the identity authentication unit of the target classified terminal to trigger immediate screen lock; Send policy instructions to the network-side firewall or switch to block subsequent communication between the target classified terminal and the destination address in the network attack alarm log.

Images