Face recognition attack test method and device, equipment, storage medium and program product

Abstract

The invention provides a face recognition attack test method and device, equipment, a storage medium and a program product, and can be applied to the technical field of biological recognition. The method comprises the steps that sensitive features and defense features are obtained according to defense rules of a target face recognition system, the sensitive features comprise an attack frequent item set and an abnormal behavior sequence, and the defense features comprise static detection rules and dynamic behavior verification logic; an attack action sequence is determined in a target attack library according to the sensitive features and the defense features, the target attack library comprises attack actions which are not matched with the sensitive features and a disturbance action set, and the attack action sequence comprises at least one attack action and at least one disturbance action which are combined in sequence; the attack action and the disturbance action in the attack action sequence are executed according to the sequence, attack testing is carried out on the target face recognition system, a testing result is obtained, and the testing result represents security vulnerabilities existing in the target face recognition system.

Description

Technical Field

[0001] This disclosure relates to the field of biometric technology, and more specifically, to a method, apparatus, device, medium, and program product for testing facial recognition attacks. Background Technology

[0002] Facial recognition is a biometric technology that identifies individuals based on their facial features. It typically involves using cameras or webcams to capture images or video streams containing faces, automatically detecting and tracking faces within the images, and then performing facial recognition. However, malicious actors are currently using various methods to attack facial recognition systems, illegally impersonating users to steal property and other malicious activities.

[0003] In the testing of facial recognition applications, current facial recognition attack strategies are mostly based on manual detection or detection of predetermined patterns, which has significant drawbacks: the number of attack models is limited, their features are prominent, and they are easily detected by defense systems; they cannot perceive changes in the sensitive features of defense models, nor can they dynamically adjust attack methods for different defense strategies, resulting in strong attack lag; and using similar attack schemes on different defense systems leads to a waste of computing resources, and it is also impossible to effectively detect security vulnerabilities in facial recognition systems. Therefore, there is an urgent need for a more efficient and adaptable attack strategy testing method. Summary of the Invention

[0004] In view of the above problems, this disclosure provides a method, apparatus, device, medium and program product for testing face recognition attacks.

[0005] According to the first aspect of this disclosure, a method for testing facial recognition attacks is provided, comprising: obtaining sensitive features and defensive features based on the defense rules of a target facial recognition system, wherein the defense rules include preset facial feature matching rules and attack action interception rules, the sensitive features include attack frequent itemsets and abnormal behavior sequences, and the defensive features include static detection rules and dynamic behavior verification logic; determining an attack action sequence in a target attack library based on the sensitive features and defensive features, wherein the target attack library includes a set of attack actions and perturbation actions that do not match the sensitive features, and the attack action sequence includes at least one attack action and at least one perturbation action combined in sequence; and executing the attack actions and perturbation actions in the attack action sequence in sequence to perform an attack test on the target facial recognition system, obtaining test results, and the test results characterizing the security vulnerabilities existing in the target facial recognition system.

[0006] According to embodiments of this disclosure, determining an attack action sequence in a target attack library based on sensitive features and defensive features includes: determining feature vectors for each attack action in the attack action sequence based on sensitive features and static detection rules; determining the time interval and order of each attack action in the attack action sequence based on dynamic behavior verification logic; wherein the feature vectors characterize facial recognition behavior features or facial recognition image features when simulating a user's facial recognition; filtering at least one candidate attack action that matches the feature vectors from the target attack library; and combining at least one candidate attack action and at least one perturbation action into an attack action sequence that satisfies the time interval and order based on the perturbation intensity and perturbation position of each perturbation action in the perturbation action set.

[0007] According to embodiments of this disclosure, combining at least one candidate attack action and at least one perturbation action into an attack action sequence that satisfies a time interval and order includes: arranging at least one candidate attack action in order to form a basic attack action sequence; filtering at least one perturbation action that matches the basic attack action sequence based on the perturbation intensity and perturbation position of each perturbation action, determining its insertion node in the basic attack action sequence, and inserting it; pre-verifying the basic attack action sequence with the inserted at least one perturbation action according to defense features; if an attack action sequence that satisfies the time interval and order is obtained, outputting the attack action sequence that satisfies the time interval and order; if an attack action sequence that does not satisfy the time interval and order is obtained, iteratively adjusting the perturbation intensity and perturbation position of the at least one perturbation action according to dynamic behavior verification logic until an attack action sequence that satisfies the time interval and order is obtained.

[0008] According to embodiments of this disclosure, the target attack library is obtained as follows: an initial attack library is constructed using multiple single attack actions; based on sensitive features, the feature matching degree between a single attack action and a frequently used attack itemset and the temporal matching degree with an abnormal behavior sequence are calculated, and single attack actions with feature matching degree or temporal matching degree exceeding a preset threshold are deleted; a set of perturbation actions is added to obtain the target attack library, wherein the set of perturbation actions includes multiple perturbation actions with different perturbation intensities and perturbation locations.

[0009] According to embodiments of this disclosure, performing attack actions and perturbation actions in an attack action sequence to test an attack on a target face recognition system includes: repeatedly performing the following operations until the attack actions and perturbation actions in the attack action sequence pass the defense: after performing the attack actions and perturbation actions in the attack action sequence, if the attack actions and perturbation actions pass the defense, outputting the attack action sequence and ending the loop; if the attack actions or perturbation actions fail the defense, adjusting the attack action sequence according to the reinforcement learning parameters in the reinforcement learning algorithm, wherein the reinforcement learning parameters include a state space, an action space, and a reward function; and executing the attack actions and perturbation actions in the adjusted attack action sequence.

[0010] According to embodiments of this disclosure, adjusting the attack action sequence based on reinforcement learning parameters in the reinforcement learning algorithm includes: using sensitive features and defense features as state variables to form a state space; associating attack actions in the target attack library with their execution costs to form an action space, wherein the execution cost includes at least one of time cost, resource cost, and business impact cost; constructing a reward function based on the attack completion degree of the attack action sequence, wherein the attack completion degree is used to optimize the attack action sequence in conjunction with the reward mechanism; and using the reinforcement learning algorithm, selecting suitable attack actions and perturbation actions from the action space according to the state space, and adjusting the corresponding attack actions, perturbation actions, order, and / or execution frequency in the attack action sequence in conjunction with the feedback signal of the reward function to obtain the adjusted attack action sequence.

[0011] According to embodiments of this disclosure, obtaining sensitive features and defensive features based on the defense rules of the target face recognition system includes: simulating a user's face-scanning operation to interact with the target face recognition system, collecting execution parameters of the corresponding defense rules, including the feature dimension threshold of the preset face feature matching rule and the timing judgment criteria of the attack action interception rule; identifying frequent attack itemsets and abnormal behavior sequences based on the execution parameters to obtain sensitive features; parsing the judgment logic of the defense rules, and extracting static detection rules and dynamic behavior verification logic to obtain defensive features.

[0012] According to embodiments of this disclosure, the triggering conditions for security vulnerabilities are obtained by associating test results, attack action sequences corresponding to the test results, and defense features; vulnerability types are classified according to the triggering conditions, including static detection vulnerabilities, dynamic verification vulnerabilities, or implicit interception vulnerabilities; remediation directions are determined for vulnerability types, including supplementing the coverage of static detection rules, optimizing the anti-disturbance algorithm of dynamic behavior verification logic, and / or adjusting at least one of the interception thresholds of defense features; and the triggering conditions, vulnerability types, and remediation directions are integrated to output analysis results.

[0013] The second aspect of this disclosure provides a face recognition attack testing apparatus, comprising: a feature acquisition module, configured to acquire sensitive features and defensive features according to the defense rules of a target face recognition system, wherein the defense rules include preset face feature matching rules and attack action interception rules, the sensitive features include attack frequent itemsets and abnormal behavior sequences, and the defensive features include static detection rules and dynamic behavior verification logic; an attack action sequence determination module, configured to determine an attack action sequence in a target attack library based on the sensitive features and defensive features, wherein the target attack library includes a set of attack actions and perturbation actions that do not match the sensitive features, and the attack action sequence includes at least one attack action and at least one perturbation action combined in sequence; and a test execution module, configured to execute the attack actions and perturbation actions in the attack action sequence in sequence to perform an attack test on the target face recognition system, and obtain test results, wherein the test results characterize the security vulnerabilities existing in the target face recognition system.

[0014] A third aspect of this disclosure provides an electronic device comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the methods described above.

[0015] A fourth aspect of this disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the methods described above.

[0016] The fifth aspect of this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0017] According to the face recognition attack testing method, apparatus, equipment, medium, and program products provided in this disclosure, by first analyzing the defense rules of the target face recognition system to extract sensitive and defensive features, targeted attack strategies can be designed, solving the problem that attacks in existing technologies are easily identified due to triggering sensitive actions. By filtering attack actions that do not match sensitive features from the target attack library and combining them with perturbation actions in an order based on defense features to form an attack action sequence, the limitations of single attack patterns and obvious features in existing technologies are overcome, improving the concealment of attacks and resistance to dynamic recognition, and effectively bypassing simple dynamic defenses. By executing the attack action sequence in sequence and dynamically adapting to the target system's defense logic with defense feedback, the coverage of security vulnerability discovery is improved, while avoiding the waste of computing resources by general attack strategies, thus optimizing resource utilization efficiency. By outputting test results characterizing security vulnerabilities, the vulnerability of the target face recognition system can be accurately located, providing a basis for subsequent defense and remediation, and improving the security protection capability of the target face recognition system. Attached Figure Description

[0018] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0019] Figure 1 The illustration schematically depicts an application scenario of a face recognition attack testing method, apparatus, device, medium, and program product according to embodiments of this disclosure;

[0020] Figure 2 A flowchart illustrating a face recognition attack testing method according to an embodiment of the present disclosure is shown schematically.

[0021] Figure 3 A flowchart illustrating a method for determining a sequence of attack actions according to an embodiment of the present disclosure is shown schematically.

[0022] Figure 4 A flowchart illustrating a method for filtering at least one candidate attack action that matches a feature vector according to an embodiment of the present disclosure is shown schematically.

[0023] Figure 5 A flowchart illustrating a method for combining at least one candidate attack action and at least one perturbation action into a sequence of attack actions satisfying a time interval and an order, according to an embodiment of the present disclosure, is shown in the schematic diagram.

[0024] Figure 6 A flowchart illustrating a method for obtaining a target attack library according to an embodiment of this disclosure is shown schematically.

[0025] Figure 7 A flowchart illustrating a method for executing attack actions and disturbance actions in an attack action sequence according to an embodiment of the present disclosure is shown schematically.

[0026] Figure 8 A schematic diagram illustrating the structure of a face recognition attack testing apparatus according to an embodiment of the present disclosure is shown; and

[0027] Figure 9 A block diagram of an electronic device suitable for implementing a face recognition attack testing method according to an embodiment of the present disclosure is shown schematically. Detailed Implementation

[0028] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0029] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0030] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0031] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0032] In the technical solution disclosed herein, the collection, storage, use, processing, transmission, provision, disclosure, and application of users' personal information comply with the provisions of relevant laws and regulations, necessary measures have been taken, and there is no violation of public order and good morals.

[0033] In the technical solution disclosed herein, the acquisition, collection, storage, use, processing, transmission, provision, disclosure, and application of data all comply with the provisions of relevant laws and regulations, necessary measures have been taken, and they do not violate public order and good morals.

[0034] It should be noted that the technical solutions disclosed herein may mention certain software, components, models, and other existing solutions in the industry. These should be considered as exemplary and are intended only to illustrate the feasibility of implementing the technical solutions of this application. However, they do not mean that the applicant has used or necessarily used such solutions.

[0035] In view of this, embodiments of this disclosure provide a method, apparatus, device, storage medium, and program product for testing facial recognition attacks. The method includes: obtaining sensitive features and defensive features based on the defense rules of the target facial recognition system, wherein the defense rules include preset facial feature matching rules and attack action interception rules, the sensitive features include frequent attack itemsets and abnormal behavior sequences, and the defensive features include static detection rules and dynamic behavior verification logic; determining an attack action sequence in a target attack library based on the sensitive features and defensive features, wherein the target attack library includes a set of attack actions and perturbation actions that do not match the sensitive features, and the attack action sequence includes at least one attack action and at least one perturbation action combined in sequence; and executing the attack actions and perturbation actions in the attack action sequence in sequence to perform an attack test on the target facial recognition system, obtaining test results, and the test results characterizing the security vulnerabilities existing in the target facial recognition system.

[0036] Figure 1 The diagram illustrates an application scenario of the face recognition attack testing method according to an embodiment of the present disclosure.

[0037] like Figure 1 As shown, the system architecture 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing communication links between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0038] Users can interact with server 105 via network 104 using at least one of the first terminal device 101, second terminal device 102, and third terminal device 103 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, second terminal device 102, and third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0039] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0040] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0041] It should be noted that the face recognition attack testing method provided in this disclosure embodiment can generally be executed by server 105. Correspondingly, the face recognition attack testing device provided in this disclosure embodiment can generally be located in server 105. The face recognition attack testing method provided in this disclosure embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the face recognition attack testing device provided in this disclosure embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0042] Alternatively, the face recognition attack testing method provided in this embodiment of the present disclosure can also be executed by the first terminal device 101, the second terminal device 102, or the third terminal device 103, or by other terminal devices different from the first terminal device 101, the second terminal device 102, or the third terminal device 103. Correspondingly, the face recognition attack testing device provided in this embodiment of the present disclosure can also be disposed in the first terminal device 101, the second terminal device 102, or the third terminal device 103, or in other terminal devices different from the first terminal device 101, the second terminal device 102, or the third terminal device 103.

[0043] It should be understood that Figure 1 The number of terminal devices, networks, and servers in the system is only a limited number. Depending on implementation needs, there can be any number of terminal devices, networks, and servers.

[0044] Figure 2 A flowchart illustrating a face recognition attack testing method according to an embodiment of the present disclosure is shown schematically.

[0045] like Figure 2 As shown, the face recognition attack testing method of this embodiment includes operations S210 to S230.

[0046] In operation S210, sensitive features and defensive features are obtained according to the defense rules of the target face recognition system. The defense rules include preset face feature matching rules and attack action interception rules. The sensitive features include attack frequent itemsets and abnormal behavior sequences. The defensive features include static detection rules and dynamic behavior verification logic.

[0047] In the embodiments of this disclosure, the target facial recognition system can refer to a facial recognition application or device that requires security vulnerability detection. Common scenarios include facial recognition for payment program login, facial recognition for community access control, and facial recognition for office attendance. Defense rules can refer to a set of pre-set attack prevention rules for the target facial recognition system, used to identify and intercept illegal attack behaviors. Specifically, they are divided into two categories: one is pre-set facial feature matching rules, which can refer to pre-defined static facial validity judgment standards; the other is attack action interception rules, which can refer to dynamic behavior judgment standards used to identify malicious attack behaviors.

[0048] In the embodiments of this disclosure, sensitive features can refer to a set of features identified from the defense rules that are highly likely to trigger system interception. These include two categories: First, frequently occurring attack itemsets, which can refer to combinations of actions that occur frequently and are intercepted at high frequencies, such as continuously obscuring the camera within a short period (e.g., obscuring it 3 times within 10 seconds) or repeatedly switching between different facial images (e.g., switching between 2 images within 2 seconds). The other category is abnormal behavior sequences, which can refer to continuous combinations of actions that do not conform to normal facial recognition logic, such as completely covering the eyes, instantly removing the obscuring force, quickly looking down, or suddenly looking up. These actions may be judged as abnormal because they violate natural facial recognition habits.

[0049] In the embodiments of this disclosure, the defensive features can refer to the specific logic that actually performs detection and interception operations, and are divided into two categories. The first is static detection rules, which can refer to detection logic targeting a single frame of a face image / fixed state, such as determining whether the current image is a real face (not a photo or printout), whether the facial features are complete (without large areas of obstruction), and whether the lighting on the face conforms to a normal environment (not extreme strong light / dark light), etc. The other is dynamic behavior verification logic, which can refer to detection logic targeting continuous face-scanning actions / temporal changes, such as determining whether the rhythm of face movement is natural (e.g., it takes 1-3 seconds to move from the side to the front, rather than within 0.5 seconds), whether the actions (blinking, opening the mouth) are continuous (not mechanically rapid blinking), and whether the action transitions are abrupt (e.g., there is no sudden change from stillness to rapid shaking), etc.

[0050] In the embodiments of this disclosure, the target facial recognition system requiring vulnerability testing is clearly identified, and the specific application scenario of the test object is determined, such as login, payment, and access control. By modeling the defense pattern of the target facial recognition system, the defense rules of the target system are obtained, resulting in preset facial feature matching rules and attack action interception rules. Based on the obtained defense rules, the sensitive features of the system are extracted, clarifying the specific manifestations of frequent attack itemsets and abnormal behavior sequences. The defense rules are further decomposed to determine defense features and clarify the specific content of static detection rules and dynamic behavior verification logic.

[0051] In operation S220, an attack action sequence is determined in the target attack library based on sensitive features and defensive features. The target attack library includes a set of attack actions and perturbation actions that do not match the sensitive features. The attack action sequence includes at least one attack action and at least one perturbation action combined in sequence.

[0052] In the embodiments of this disclosure, the target attack library can refer to a pre-built set of attack-related actions, characterized in that all included actions do not match sensitive features, and are used to generate targeted attack action sequences. The perturbation action set can refer to auxiliary action types in the target attack library, referring to behaviors used to interfere with the system's defense detection logic, such as slightly shaking the camera, adjusting the shooting light, or slightly moving the face position, which helps increase the probability of bypassing the defense. The attack action sequence can refer to an action chain formed by combining attack actions and perturbation actions from the target attack library in a specific order, increasing the probability of bypassing the defense through the combination of attack and perturbation, and containing at least one attack action and one perturbation action.

[0053] In the embodiments of this disclosure, a pre-built target attack library is invoked to confirm that all actions in the target attack library meet the requirement of not matching sensitive features, excluding frequent attack itemsets and abnormal behavior sequences that would trigger interception. Combined with extracted sensitive features and defense features, suitable attack actions are selected. From the set of perturbation actions in the target attack library, auxiliary actions that can interfere with the target system's defense detection are selected. Attack actions and perturbation actions are combined in a certain order to form an attack action sequence, which includes at least one attack action and one perturbation action.

[0054] In operation S230, attack actions and disturbance actions in the attack action sequence are executed in sequence to perform attack tests on the target face recognition system and obtain test results. The test results characterize the security vulnerabilities existing in the target face recognition system.

[0055] In the embodiments of this disclosure, attack testing refers to simulating a real-world attack scenario by launching an attempt against a target facial recognition system according to a sequence of attack actions. The purpose is to verify the defense capabilities of the target facial recognition system and discover potential security vulnerabilities. Security vulnerabilities can refer to defects in the defensive design or implementation of the target facial recognition system, which can lead to illegal attacks breaching the system. For example, each action is executed sequentially according to a defined sequence of attack actions, controlling the rhythm and magnitude of the action execution to simulate a real user's facial recognition operation. During the execution of the action sequence, the feedback from the target facial recognition system is recorded in real time, including whether a certain stage of detection is passed, whether an interception prompt is triggered, and the specific action node during interception. After the entire attack action sequence is executed, the data from the testing process is summarized to form test results. The defensive defects of the target facial recognition system are analyzed based on the test results.

[0056] According to embodiments of this disclosure, by first parsing the defense rules of the target facial recognition system to extract sensitive and defensive features, targeted attack strategies can be designed, solving the problem in existing technologies where attacks are easily identified due to triggering sensitive actions. By filtering attack actions that do not match sensitive features from the target attack database and combining them with perturbation actions in a sequence based on defense features, an attack action sequence is formed. This breaks the limitations of existing technologies with single attack patterns and obvious features, improving the stealth and resistance to dynamic recognition, and effectively bypassing simple dynamic defenses. By executing the attack action sequence sequentially and dynamically adapting to the target system's defense logic with defense feedback, the coverage of security vulnerability discovery is improved, while avoiding the waste of computational resources by general attack strategies, thus optimizing resource utilization efficiency. By outputting test results characterizing security vulnerabilities, the vulnerability of the target facial recognition system can be accurately located, providing a basis for subsequent defense and remediation, and improving the security protection capabilities of the target facial recognition system.

[0057] Figure 3 A flowchart illustrating a method for determining a sequence of attack actions according to an embodiment of the present disclosure is shown schematically.

[0058] like Figure 3 As shown, the method for determining the attack action sequence in this embodiment includes operations S310 to S330.

[0059] In operation S310, the feature vector of each attack action in the attack action sequence is determined according to the sensitive features and static detection rules. The time interval and order of each attack action in the attack action sequence are determined according to the dynamic behavior verification logic. The feature vector represents the facial recognition behavior features or facial recognition image features when simulating a user's facial recognition.

[0060] In the embodiments of this disclosure, the feature vector can refer to a set of parameters used to quantify and describe the attributes of the attack action, representing the facial recognition behavior features or facial recognition image features when simulating a user's facial recognition. Facial recognition behavior features can refer to the dynamic behavioral attributes of a simulated user performing a facial recognition operation. Facial recognition image features can refer to the static attributes of the facial image acquired during the facial recognition process. The time interval can refer to the execution time difference between two adjacent actions in the attack action sequence, such as a 1-second interval after the first attack action ends before executing the next action.

[0061] For example, by combining extracted sensitive features and static detection rules, the constraints that the attack actions must meet are clarified, and these constraints are transformed into quantifiable feature vectors. Based on the extracted dynamic behavior verification logic, the time interval of the attack actions is determined. The execution order of the attack actions is determined by analyzing the defense rules of the target face recognition system and combining them with natural logic, avoiding disordered sequences that are judged as abnormal behavior sequences.

[0062] In operation S320, at least one candidate attack action that matches the feature vector is selected from the target attack library.

[0063] In embodiments of this disclosure, candidate attack actions can refer to attack actions selected from a target attack database whose features completely match or highly fit the determined feature vectors. For example... Figure 4 As shown, the process iterates through all attack actions in the target attack database, extracting the inherent features of each action, including facial recognition behavior features and facial recognition image features. The inherent features of each attack action are compared with a defined feature vector to filter out matching attack actions. For example, the action feature of slowly turning the head 35° in the attack database matches the feature vector of a head turning angle of 35° and a head turning speed of 0.5° / second; the action feature of blinking naturally once every 2 seconds matches the feature vector related to blinking frequency. The results are output, and the number of candidate attack actions filtered out is at least one. If no match is found, the comparison process is returned for re-comparison.

[0064] In operation S330, based on the perturbation intensity and perturbation location of each perturbation action in the perturbation action set, at least one candidate attack action and at least one perturbation action are combined into an attack action sequence that satisfies the time interval and order.

[0065] In the embodiments of this disclosure, the disturbance intensity can refer to the degree of interference of the disturbance action on the target system's defense detection logic. For example, shaking the camera device with an amplitude ≤3cm is considered a low-intensity disturbance, and an amplitude of 5-8cm is considered a medium-intensity disturbance. The selection should be based on the sensitivity of the defense features. For example, for highly sensitive dynamic verification logic, a low-intensity disturbance should be prioritized to avoid triggering interception. The disturbance location can refer to the object or scenario in which the disturbance action is applied, such as acting on the camera device, facial area, or shooting environment. It needs to be adapted to the scenario in which the attack action is implemented.

[0066] For example, the perturbation intensity and location information of each perturbation action are extracted from the set of perturbation actions in the target attack library. Combined with the defense characteristics of the target system, suitable perturbation actions are selected. The selected candidate attack actions are combined with perturbation actions according to a defined time interval and order, such as candidate attack action 1 (slowly turning the head 35°) at a time interval of 0.8 seconds, perturbation action (minor adjustment of facial position) at a time interval of 1.2 seconds, candidate attack action 2 (natural blinking), etc. The combined sequence is verified to ensure it meets logical requirements and does not trigger sensitive feature interception. If it does not meet these requirements, the corresponding actions are adjusted and modified to ultimately form a complete attack action sequence.

[0067] According to embodiments of this disclosure, by combining the sensitive and defensive features of the target facial recognition system, the feature vector of the attack action is quantified and the time interval and sequence of the action execution are clarified, which facilitates the accurate selection of suitable candidate attack actions. At the same time, based on the perturbation intensity and perturbation location of the perturbation action, targeted combination can effectively improve the adaptability of the attack action sequence to the target system's defense logic, and avoid triggering interception due to actions not conforming to defense rules; thereby improving the accuracy and effectiveness of attack testing, and enabling more efficient identification of existing security vulnerabilities.

[0068] Figure 5 The flowchart illustrates a method for combining at least one candidate attack action and at least one perturbation action into an attack action sequence that satisfies a time interval and a sequence, according to an embodiment of the present disclosure.

[0069] In the embodiments of this disclosure, at least one candidate attack action is arranged in order to form a basic attack action sequence; based on the perturbation intensity and perturbation position of each perturbation action, at least one perturbation action that matches the basic attack action sequence is selected, and its insertion node in the basic attack action sequence is determined and inserted; the basic attack action sequence of the inserted and adapted at least one perturbation action is pre-verified according to the defense features; if an attack action sequence that satisfies the time interval and order is obtained, the attack action sequence that satisfies the time interval and order is output; if an attack action sequence that does not satisfy the time interval and order is obtained, the perturbation intensity and perturbation position of the adapted at least one perturbation action are iteratively adjusted according to the dynamic behavior verification logic until an attack action sequence that satisfies the time interval and order is obtained.

[0070] like Figure 5As shown, according to the preset action order, all candidate attack actions are arranged sequentially. The arranged sequence is confirmed to have no logical conflicts, forming a basic attack sequence containing only attack actions. The perturbation intensity and position of each perturbation action in the perturbation action set are extracted. The execution characteristics of each candidate attack action in the basic attack sequence are analyzed, and perturbation actions with suitable perturbation intensity and position are selected. Considering the time interval requirements of the basic attack sequence, the gap between adjacent candidate attack actions is selected as the insertion node, ensuring that the insertion does not affect the execution rhythm of the original attack action. The selected suitable perturbation actions are inserted into the corresponding nodes, forming an initial combined sequence containing both attack actions and perturbation actions. Based on the defense characteristics of the target face recognition system, the initial combined sequence after inserting perturbation actions is tested to determine whether it meets the time interval and order requirements. If the pre-verification result is satisfactory, the combined sequence is the final attack action sequence, and this attack action sequence is output for subsequent attack testing. If the pre-verification result is unsatisfactory, the parameters of the perturbation action are adjusted using algorithms such as Random Forest, based on the dynamic behavior verification logic. This includes reducing the perturbation strength from medium to low, adjusting the inserted node to extend the time interval to 0.6 seconds, or changing the perturbation position. The adjusted perturbation action is then re-inserted into the basic attack sequence to form a new combined sequence. Iterative adjustment refers to repeatedly performing pre-verification, adjusting if unsatisfactory, re-inserting, and pre-verifying again, until a pre-verification result satisfies the time interval and sequence requirements. This sequence is then determined as the final attack action sequence and output.

[0071] For example, a basic attack sequence may refer to a combination of actions formed solely by arranging candidate attack actions in a preset order, without containing any perturbation actions. An adapted perturbation action may refer to a perturbation action selected from the set of perturbation actions, whose perturbation intensity and location match the action type and execution rhythm of the basic attack sequence, and which will not trigger sensitive feature interception. An insertion node may refer to the time interval between two adjacent candidate attack actions in the basic attack sequence, or a reasonable time point before / after the execution of a single candidate attack action. Inserting a perturbation action must not disrupt the logic and execution rhythm of the basic attack sequence. Pre-verification may refer to a preliminary verification stage conducted on the feasibility, compatibility, and defense evasion capabilities of the attack action sequence after inserting a perturbation action. For example, verifying whether there are conflicts in the execution logic between the perturbation action and the attack action, checking whether the perturbation action matches any sensitive features, verifying whether the attack action sequence after inserting the perturbation action conforms to the static detection rules and dynamic behavior verification logic of the target system, etc.

[0072] According to embodiments of this disclosure, by first constructing a basic attack sequence containing only candidate attack actions, then filtering and matching actions based on the perturbation strength and position of the perturbation actions and accurately determining the insertion node to complete the combination, and then performing pre-verification, adjusting the perturbation parameters, and performing pre-verification again, the execution conflict between the perturbation actions and the attack actions can be effectively avoided, the triggering of sensitive feature interception can be avoided, the fit between the attack action sequence and the dynamic behavior verification logic can be improved, the stability and reliability of attack testing can be improved, the execution of invalid test actions can be reduced, resource utilization efficiency can be improved, and more accurate directions can be provided for vulnerability remediation.

[0073] Figure 6 A flowchart illustrating a method for obtaining a target attack library according to an embodiment of this disclosure is shown schematically.

[0074] like Figure 6 As shown, the method for obtaining the target attack library in this embodiment includes operations S610 to S630.

[0075] When operating the S610, an initial attack library is built using multiple single attack actions.

[0076] In the embodiments of this disclosure, a single attack action can refer to an independent attack behavior that is not combined with other actions, such as turning the head at a fixed angle or displaying a single facial expression. This serves as the basic unit for constructing the initial attack library. The initial attack library can refer to a set of original attack actions consisting of multiple unrelated single attack actions that have not undergone sensitive feature filtering and only possess basic attack functions.

[0077] For example, common attack behaviors in face recognition attack scenarios are obtained, and single attack actions are extracted to make the action types cover different dimensions such as static and dynamic, forming an initial attack library.

[0078] In operation S620, based on sensitive features, the feature matching degree between a single attack action and the frequent attack itemset and the temporal matching degree with the abnormal behavior sequence are calculated, and single attack actions with feature matching degree or temporal matching degree exceeding the preset threshold are deleted.

[0079] For example, based on the sensitive features of the target face recognition system, the feature parameters of frequently attacked itemsets and abnormal behavior sequences are extracted. For each single attack action in the initial attack database, two key indicators are calculated: comparing the features of the single attack action with the features of the frequently attacked itemsets to obtain a quantitative value of the degree of overlap, such as a percentage, i.e., feature matching degree; comparing the execution sequence of the single attack action with the sequence of abnormal behavior to obtain a quantitative value of the degree of overlap, such as a percentage, i.e., temporal matching degree. According to preset thresholds, the matching degree of each single attack action is judged one by one. If the feature matching degree exceeds the preset threshold, or the temporal matching degree exceeds the preset threshold, it indicates that the action is likely to trigger sensitive feature interception, and it is deleted from the initial attack database. If neither matching degree exceeds the preset threshold, the action is retained in the database.

[0080] In operation S630, a set of perturbation actions is added to obtain the target attack library. The set of perturbation actions includes multiple perturbation actions with different perturbation intensities and locations.

[0081] For example, a set of perturbation actions is constructed based on a variety of perturbation actions with different perturbation intensities and locations, and added to a filtered attack library, which together with the retained single attack actions form a target attack library.

[0082] According to embodiments of this disclosure, by constructing an initial attack library based on a single attack action, combining the sensitive features of the target system, calculating the feature matching degree between the single attack action and the attack frequent itemset, and the temporal matching degree with the abnormal behavior sequence, deleting high-interception-risk actions with matching degrees exceeding a preset threshold, and then supplementing with a set of perturbation actions containing different perturbation intensities and locations, the actions in the target attack library can avoid interception triggered by sensitive features, improving the usability and security of the target attack library, thereby improving the efficiency and accuracy of subsequent attack action sequence combinations, while also enhancing the diversity and adaptability of attack action sequences.

[0083] Figure 7 A flowchart illustrating a method for performing attack actions and disturbance actions in a sequence of attack actions according to an embodiment of the present disclosure is shown.

[0084] In embodiments of this disclosure, the attack actions and perturbation actions in the attack action sequence are executed sequentially to perform an attack test on the target face recognition system. This includes: repeatedly executing the following operations until the attack actions and perturbation actions in the attack action sequence pass the defense: after executing the attack actions and perturbation actions in the attack action sequence, if the attack actions and perturbation actions pass the defense, outputting the attack action sequence and ending the loop; if the attack actions or perturbation actions fail the defense, adjusting the attack action sequence according to the reinforcement learning parameters in the reinforcement learning algorithm, wherein the reinforcement learning parameters include a state space, an action space, and a reward function; and executing the attack actions and perturbation actions in the adjusted attack action sequence.

[0085] like Figure 7 As shown, a predetermined initial attack action sequence is retrieved. Following the order and time intervals in the sequence, all attack and perturbation actions are executed in a simulated real-world face recognition scenario. The feedback result from the target face recognition system is recorded. If the feedback result indicates successful defense, the currently executed attack action sequence is output, and the entire loop ends. This sequence is considered a valid attack sequence capable of breaching the defense, and subsequent system vulnerability analysis can be based on this sequence. If the feedback result indicates failure to pass the defense, the sequence is adjusted based on the reinforcement learning parameters in the reinforcement learning algorithm. Specifically, based on the state space, the current system defense state and the current sequence state are defined; based on the action space, feasible adjustment directions are selected, such as adjusting the intensity of perturbation actions, changing the position of perturbation actions, and modifying the time interval between the action and the preceding and following attack actions; based on the reward function, different adjustment directions are evaluated. Combining the above parameter analysis, the optimal adjustment scheme is determined, and the attack action sequence is modified. The adjusted attack action sequence is executed, and the process of judging the defense result and adjusting the sequence based on reinforcement learning parameters is repeated until a certain execution results in successful defense, at which point the final sequence is output and the loop ends.

[0086] In the embodiments of this disclosure, a reinforcement learning algorithm can refer to a machine learning algorithm whose logic is to gradually learn the optimal policy through a cycle of environmental interaction, feedback rewards, and policy adjustments. Specific reinforcement learning algorithms include, but are not limited to, Monte Carlo reinforcement learning algorithms, classical value function methods, policy gradient methods, etc., and are not limited here. Reinforcement learning parameters can refer to the set of parameters supporting the operation of the reinforcement learning algorithm, including three types of key parameters. The state space can refer to the set of environmental state descriptions in reinforcement learning, here referring to the sum of the defensive state and the current state of the attack action sequence of the target face recognition system. The action space can refer to the set of adjustment operations that the agent can execute in reinforcement learning, here referring to all optimizable directions for the attack action sequence, such as adjusting the amplitude / speed of the attack action, the intensity / position of the perturbation action, the time interval between action executions, the order of actions, etc. The reward function can refer to the evaluation criteria of the reinforcement learning algorithm, setting quantitative rules based on the attack completion degree, and guiding the algorithm to learn the optimal adjustment policy through positive rewards such as encouraging effective adjustments and negative rewards such as avoiding ineffective adjustments.

[0087] According to embodiments of this disclosure, by constructing a loop optimization mechanism that executes attack actions, determines the defense pass status, adjusts the sequence based on reinforcement learning parameters, and re-executes, the mechanism dynamically adapts to the defense feedback of the target face recognition system, accurately iterates and optimizes the attack action sequence, avoids test failures caused by a single fixed sequence, and improves the success rate of attack sequences breaking through system defenses; it also improves testing efficiency and resource utilization, providing a more targeted basis for vulnerability remediation.

[0088] In embodiments of this disclosure, adjusting the attack action sequence according to the reinforcement learning parameters in the reinforcement learning algorithm includes: using sensitive features and defense features as state variables to form a state space; associating attack actions in the target attack library with their execution costs to form an action space, wherein the execution cost includes at least one of time cost, resource cost, and business impact cost; constructing a reward function based on the attack completion degree of the attack action sequence, wherein the attack completion degree is used to optimize the attack action sequence in conjunction with the reward mechanism; and using the reinforcement learning algorithm, selecting suitable attack actions and perturbation actions from the action space according to the state space, and adjusting the corresponding attack actions, perturbation actions, order, and / or execution frequency in the attack action sequence in conjunction with the feedback signal of the reward function to obtain the adjusted attack action sequence.

[0089] In the embodiments of this disclosure, execution cost can refer to the cost incurred in performing a certain attack or disturbance action, including at least one type of cost. Time cost can refer to the time required to complete a single attack or disturbance action. Resource cost can refer to the computing resources, hardware resources, etc., consumed during the execution of the action. Business impact cost can refer to the degree of interference of the action execution on normal business or testing processes. Attack completion rate can refer to an indicator measuring the effectiveness of the attack action sequence, used to reflect the progress of the attack test. Feedback signal can refer to the quantitative result output by the reward function, which is the basis for the reinforcement learning algorithm to judge the effectiveness of adjusting actions and thus optimize the attack sequence.

[0090] For example, based on the sensitive and defensive features of the target facial recognition system, the specific parameters of each type of feature are defined. Each specific feature parameter is transformed into a quantifiable and describable state variable, and all state variables are organized to form a state space. All attack actions and perturbation actions in the target attack library are extracted, and at least one execution cost is defined for each action. Each action is associated and bound with its corresponding execution cost, and all action and cost combinations are summarized to form a complete action space. A measurement dimension for attack completion is defined to construct a reward function, and reward rules are set based on the measurement dimension. The reward function can accurately quantify the effect and cost balance of each adjustment action. For example, if the attack action sequence passes the defense (100% attack completion), the highest positive reward is given; if it is close to passing the defense (e.g., only triggering non-interception rules), a medium positive reward is given; if the interception rule is triggered (e.g., frequent attack itemset interception), a severe negative reward is given; if the non-interception rule is triggered, a slight negative reward is given, and so on. Furthermore, if the attack is identified, -100; if a static attack is passed, +20; if a dynamic attack is passed, +50; if a static attack is used, -5; if a dynamic attack is used, -10, and so on.

[0091] For example, using a reinforcement learning algorithm, based on the execution feedback of the current attack action sequence, if the defense fails, a dynamic behavior verification interception is triggered, locating the corresponding specific state in the state space. Attack actions and perturbation actions that fit this state are selected from the action space. Selection criteria may include, but are not limited to, circumventing the current interception rules, reasonable execution cost, and positive expected feedback from the reward function. Based on the feedback signal from the reward function, the attack action sequence is adjusted accordingly. This adjustment may include changing the action type (e.g., replacing the perturbation action), adjusting the action order (e.g., changing the sequence between attack actions and perturbation actions), and reducing the execution frequency (e.g., reducing the repetition count of a certain attack action), outputting the adjusted attack action sequence.

[0092] According to embodiments of this disclosure, by constructing a state space, action space, and reward function in a reinforcement learning algorithm, and by selecting suitable actions based on the state space and adjusting the action type, order, and execution frequency of the attack action sequence in combination with reward feedback signals, the pertinence and operability of the reinforcement learning adjustment strategy can be improved. Under the premise of controlling testing costs and reducing business interference, it can quickly converge to the optimal attack action sequence, more accurately break through system defenses, and improve the optimization efficiency and adaptation accuracy of the attack action sequence.

[0093] In the embodiments of this disclosure, obtaining sensitive features and defensive features based on the defense rules of the target face recognition system includes: simulating a user's face-scanning operation to interact with the target face recognition system, collecting the execution parameters of the corresponding defense rules, including the feature dimension threshold of the preset face feature matching rule and the timing judgment criteria of the attack action interception rule; identifying frequent attack itemsets and abnormal behavior sequences based on the execution parameters to obtain sensitive features; parsing the judgment logic of the defense rules, and extracting static detection rules and dynamic behavior verification logic to obtain defensive features.

[0094] In the embodiments of this disclosure, the execution parameters of the defense rules can refer to the specific quantitative standards or judgment criteria used by the target face recognition system when executing the defense rules. These parameters are a concrete representation of the defense rules and mainly include two types. The feature dimension threshold of the preset face feature matching rule can refer to the specific quantitative critical value used to determine if a face feature match is qualified, such as the facial feature point matching degree threshold, facial contour similarity threshold, and feature point coordinate deviation threshold. The timing judgment standard of the attack action interception rule can refer to the time-related standard used by the system to determine whether a certain behavior is an attack action, such as the threshold for the number of face scans per unit time, the action execution interval threshold, and the dynamic action completion time threshold.

[0095] For example, firstly, a user's face-scanning operation is simulated to interact with the target face recognition system. The face recognition pattern is identified and modeled, using algorithms such as decision trees, and the specific execution parameters when the defense rules are triggered are extracted. From feedback such as failed face feature matching, the feature dimension thresholds of the preset face feature matching rules are collected. From feedback such as frequent operation interception and abnormal dynamic actions, the temporal judgment criteria for attack action interception rules are collected. The collected temporal judgment criteria are analyzed to define the specific range of frequent attack itemsets. Combining the feature dimension thresholds and temporal judgment criteria, abnormal behavior sequences are defined. The frequent attack itemsets and abnormal behavior sequences are summarized to form sensitive features. For example, based on the execution parameters, the overall judgment logic of the defense rules is analyzed. Detection criteria specific to static face images are separated, clarifying the specific content of static detection rules. Verification criteria for dynamic actions during face-scanning are separated, clarifying the specific requirements of dynamic behavior verification logic. The static detection rules and dynamic behavior verification logic are summarized to form defense features.

[0096] According to embodiments of this disclosure, frequent attack itemsets and abnormal behavior sequences are identified by collecting execution parameters to form sensitive features. The inherent judgment logic of defense rules is analyzed and static detection rules and dynamic behavior verification logic are extracted to obtain defense features, thereby improving the authenticity, accuracy and completeness of sensitive features and defense features, and providing a reliable data foundation for subsequent operations.

[0097] In the embodiments of this disclosure, the triggering conditions of security vulnerabilities are obtained by associating test results, attack action sequences corresponding to the test results, and defense features; vulnerability types are classified according to the triggering conditions, wherein the vulnerability types include static detection vulnerabilities, dynamic verification vulnerabilities, or implicit interception vulnerabilities; remediation directions are determined for vulnerability types, wherein the remediation directions include supplementing the coverage of static detection rules, optimizing the anti-disturbance algorithm of dynamic behavior verification logic, and / or adjusting at least one of the interception thresholds of defense features; and the triggering conditions, vulnerability types, and remediation directions are integrated to output analysis results.

[0098] In the embodiments of this disclosure, the triggering condition of a security vulnerability can refer to the specific causal combination that leads to a security vulnerability in the target facial recognition system, formed by the correlation of test results, the corresponding attack action sequence, and defense features. The vulnerability type can refer to the classification and definition of security vulnerabilities based on the triggering condition, covering three types to facilitate the development of targeted remediation strategies. Specifically, static detection vulnerabilities refer to vulnerabilities caused by defects in static detection rules, such as insufficient coverage or unreasonable judgment criteria, such as static rules failing to identify slightly tampered facial images. Dynamic verification vulnerabilities refer to vulnerabilities caused by defects in dynamic behavior verification logic, such as weak anti-disturbance capabilities or inaccurate timing judgment, such as dynamic logic being easily interfered with by low-intensity disturbance actions. Latent interception vulnerabilities refer to latent defects not explicitly covered by defense rules and difficult to detect by conventional testing, but which can be triggered by specific attack action sequences, such as a certain type of abnormal action combination not defined by interception rules that can bypass defenses. The remediation direction can refer to specific optimization schemes formulated for different vulnerability types, directly corresponding to the root cause of the vulnerability and possessing operability.

[0099] For example, extract the elements of an attack test: the test result, the sequence of attack actions corresponding to that result, and the defense characteristics of the target system. Establish the relationship between these three elements, such as clarifying how a certain sequence of attack actions, under the constraint of a certain defense characteristic, leads to a certain test result, thus forming a specific description of the triggering conditions. Confirm that there are no logical contradictions in the triggering conditions, and that the triggering conditions accurately reflect the causal relationship of the vulnerability. Analyze the root cause of the vulnerability in the triggering conditions to match the vulnerability type, such as static detection vulnerabilities, dynamic verification vulnerabilities, and latent interception vulnerabilities. Select appropriate remediation directions for the corresponding vulnerability type. For example, for static detection vulnerabilities, prioritize supplementing the coverage of static detection rules or adjusting the interception threshold of static detection rules; for dynamic verification vulnerabilities, prioritize optimizing the anti-disturbance algorithm of dynamic behavior verification logic or adjusting the interception threshold of dynamic behavior verification logic; for latent interception vulnerabilities, combine supplementing the coverage of static detection rules, supplementing dynamic behavior verification logic scenarios, adjusting the interception threshold, and adding interception rules for uncovered abnormal actions. By integrating the triggering conditions, vulnerability types, and identified remediation directions of security vulnerabilities, a clear and intuitive analysis report is generated, which helps developers locate vulnerabilities and implement remediation based on the report.

[0100] According to embodiments of this disclosure, by associating attack test results, corresponding attack action sequences, and defense characteristics, the triggering conditions of security vulnerabilities can be accurately located, avoiding the problem of unclear root causes of vulnerabilities. Then, the vulnerability types are clearly classified according to the triggering conditions, and the remediation direction is determined in a targeted manner. Finally, the triggering conditions, vulnerability types, and remediation directions are integrated to output complete analysis results, which can improve the accuracy of vulnerability location, the rationality of vulnerability classification, and the targeting of remediation directions, thereby improving the efficiency of vulnerability remediation.

[0101] Based on the above-described face recognition attack testing method, this disclosure also provides a face recognition attack testing device. The following will be combined with... Figure 8 The device is described in detail.

[0102] Figure 8 A schematic block diagram of a face recognition attack testing apparatus according to an embodiment of the present disclosure is shown.

[0103] like Figure 8 As shown, the face recognition attack testing device 800 of this embodiment includes a feature acquisition module 810, an attack action sequence determination module 820, and an execution test module 830.

[0104] The feature acquisition module 810 is used to obtain sensitive features and defensive features according to the defense rules of the target face recognition system. The defense rules include preset face feature matching rules and attack action interception rules. The sensitive features include frequent attack itemsets and abnormal behavior sequences. The defensive features include static detection rules and dynamic behavior verification logic. In one embodiment, the feature acquisition module 810 can be used to perform the operation S210 described above, which will not be repeated here.

[0105] The attack action sequence determination module 820 is used to determine an attack action sequence from a target attack library based on sensitive features and defensive features. The target attack library includes a set of attack actions and perturbation actions that do not match the sensitive features. The attack action sequence includes at least one attack action and at least one perturbation action combined in sequence. In one embodiment, the attack action sequence determination module 820 can be used to perform the operation S220 described above, which will not be repeated here.

[0106] The test execution module 830 is used to execute the attack actions and perturbation actions in the attack action sequence in sequence to perform attack tests on the target face recognition system and obtain test results. The test results characterize the security vulnerabilities existing in the target face recognition system. In one embodiment, the test execution module 830 can be used to execute the operation S230 described above, which will not be repeated here.

[0107] According to embodiments of this disclosure, the attack action sequence determination module 820 is further configured to determine the feature vector of each attack action in the attack action sequence based on sensitive features and static detection rules, determine the time interval and order of each attack action in the attack action sequence based on dynamic behavior verification logic, wherein the feature vector characterizes the facial recognition behavior features or facial recognition image features when simulating a user's facial recognition; filter at least one candidate attack action that matches the feature vector from the target attack library; and combine at least one candidate attack action and at least one perturbation action into an attack action sequence that satisfies the time interval and order based on the perturbation intensity and perturbation position of each perturbation action in the perturbation action set.

[0108] According to embodiments of this disclosure, the attack action sequence determination module 820 is further configured to arrange at least one candidate attack action in sequence to form a basic attack sequence; based on the perturbation intensity and perturbation position of each perturbation action, filter at least one perturbation action that is compatible with the basic attack sequence, determine its insertion node in the basic attack sequence, and insert it; cyclically execute the following operations until an attack action sequence that satisfies the time interval and order is obtained: pre-verify the basic attack sequence of the inserted at least one perturbation action according to the defense features to obtain an attack action sequence that satisfies the time interval and order, and end the loop; if an attack action sequence that does not satisfy the time interval and order is obtained, adjust the perturbation intensity and perturbation position of the adapted at least one perturbation action according to the dynamic behavior verification logic; pre-verify the basic attack sequence of the inserted at least one perturbation action.

[0109] According to embodiments of this disclosure, the face recognition attack testing device 800 further includes a target attack library acquisition module, which is used to construct an initial attack library with multiple single attack actions; calculate the feature matching degree between a single attack action and a set of attack frequency items and the temporal matching degree with an abnormal behavior sequence based on sensitive features; delete single attack actions whose feature matching degree or temporal matching degree exceeds a preset threshold; add a set of perturbation actions to obtain the target attack library, wherein the set of perturbation actions includes multiple perturbation actions with different perturbation intensities and perturbation locations.

[0110] According to embodiments of this disclosure, the test module 830 is further configured to repeatedly perform the following operations until the attack action and perturbation action in the attack action sequence pass the defense: after executing the attack action and perturbation action in the attack action sequence, if the attack action and perturbation action pass the defense, output the attack action sequence and end the loop; if the attack action or perturbation action fails the defense, adjust the attack action sequence according to the reinforcement learning parameters in the reinforcement learning algorithm, wherein the reinforcement learning parameters include the state space, action space and reward function; execute the attack action and perturbation action in the adjusted attack action sequence.

[0111] According to embodiments of this disclosure, the execution test module 830 is further configured to use sensitive features and defense features as state variables to form a state space; associate attack actions in the target attack library with their execution costs to form an action space, wherein the execution cost includes at least one of time cost, resource cost, and business impact cost; construct a reward function based on the attack completion degree of the attack action sequence, wherein the attack completion degree is used to optimize the attack action sequence in conjunction with the reward mechanism; and through a reinforcement learning algorithm, select suitable attack actions and perturbation actions from the action space according to the state space, and adjust the corresponding attack actions, perturbation actions, order, and / or execution frequency in the attack action sequence in conjunction with the feedback signal of the reward function to obtain the adjusted attack action sequence.

[0112] According to embodiments of this disclosure, the feature module 810 is further used to simulate user face scanning operations and interact with the target face recognition system, collect execution parameters of corresponding defense rules, including feature dimension thresholds of preset face feature matching rules and timing judgment criteria of attack action interception rules; identify frequent attack itemsets and abnormal behavior sequences based on execution parameters to obtain sensitive features; parse the judgment logic of defense rules, and extract static detection rules and dynamic behavior verification logic to obtain defense features.

[0113] According to embodiments of this disclosure, the face recognition attack testing device 800 further includes an analysis module. The analysis module is used to associate test results, attack action sequences corresponding to the test results, and defense features to obtain the triggering conditions of security vulnerabilities; classify vulnerability types according to the triggering conditions, wherein the vulnerability types include static detection vulnerabilities, dynamic verification vulnerabilities, or implicit interception vulnerabilities; determine the remediation direction for the vulnerability type, wherein the remediation direction includes supplementing the coverage of static detection rules, optimizing the anti-disturbance algorithm of dynamic behavior verification logic, and / or adjusting at least one of the interception thresholds of defense features; integrate the triggering conditions, vulnerability types, and remediation directions, and output the analysis results.

[0114] According to embodiments of this disclosure, any plurality of modules among the feature-obtaining module 810, the attack action sequence determination module 820, and the test execution module 830 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the feature-obtaining module 810, the attack action sequence determination module 820, and the test execution module 830 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging circuitry, or implemented in any one of software, hardware, and firmware methods, or in a suitable combination of any of these. Alternatively, at least one of the feature-obtaining module 810, the attack action sequence determination module 820, and the test execution module 830 can be at least partially implemented as a computer program module, which, when run, can perform corresponding functions.

[0115] Figure 9 A block diagram of an electronic device suitable for implementing a face recognition attack testing method according to an embodiment of the present disclosure is shown schematically.

[0116] like Figure 9As shown, an electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage portion 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0117] RAM 903 stores various programs and data required for the operation of electronic device 900. Processor 901, ROM 902, and RAM 903 are interconnected via bus 904. Processor 901 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 902 and / or RAM 903. It should be noted that the programs may also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0118] According to embodiments of this disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to a bus 904. The electronic device 900 may also include one or more of the following components connected to the I / O interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I / O interface 905 as needed. A removable medium 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 910 as needed so that computer programs read from it can be installed into the storage section 908 as needed.

[0119] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0120] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 902 and / or RAM 903 and / or one or more memories other than ROM 902 and RAM 903 described above.

[0121] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the item recommendation method provided in the embodiments of this disclosure.

[0122] When the computer program is executed by the processor 901, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0123] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 909, and / or installed from a removable medium 911. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0124] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0125] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on a user's computing device, partially on a user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0126] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0127] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0128] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A method for testing facial recognition attacks, comprising: Sensitive features and defensive features are obtained based on the defense rules of the target face recognition system. The defense rules include preset face feature matching rules and attack action interception rules. The sensitive features include attack frequent itemsets and abnormal behavior sequences. The defensive features include static detection rules and dynamic behavior verification logic. An attack action sequence is determined in the target attack database based on the sensitive features and the defense features, wherein the target attack database includes a set of attack actions and perturbation actions that do not match the sensitive features, and the attack action sequence includes at least one attack action and at least one perturbation action combined in sequence. According to the order described, attack actions and disturbance actions in the attack action sequence are executed to perform attack tests on the target face recognition system and obtain test results, which characterize the security vulnerabilities existing in the target face recognition system.

2. The method according to claim 1, characterized in that, The step of determining the attack action sequence in the target attack database based on the sensitive features and the defensive features includes: The feature vectors of each attack action in the attack action sequence are determined according to the sensitive features and the static detection rules. The time interval and order of each attack action in the attack action sequence are determined according to the dynamic behavior verification logic. The feature vectors characterize the facial recognition behavior features or facial recognition image features when simulating a user's facial recognition. Filter at least one candidate attack action from the target attack library that matches the feature vector; Based on the perturbation intensity and perturbation location of each perturbation action in the set of perturbation actions, the at least one candidate attack action and the at least one perturbation action are combined into the attack action sequence that satisfies the time interval and the order.

3. The method according to claim 1, characterized in that, The step of combining the at least one candidate attack action and the at least one perturbation action into an attack action sequence that satisfies the time interval and the order includes: According to the aforementioned order, the at least one candidate attack action is arranged to form a basic attack action sequence; Based on the perturbation intensity and perturbation location of each perturbation action, at least one perturbation action that is compatible with the basic attack action sequence is selected, and its insertion node in the basic attack action sequence is determined and inserted. Based on the defense features, the basic attack action sequence of inserting at least one perturbation action of the adaptation is pre-validated. If an attack action sequence that satisfies the time interval and the order is obtained, the attack action sequence that satisfies the time interval and the order is output. If an attack action sequence that does not satisfy the time interval and the order is obtained, the perturbation intensity and perturbation position of at least one adapted perturbation action are iteratively adjusted according to the dynamic behavior verification logic until an attack action sequence that satisfies the time interval and the order is obtained.

4. The method according to claim 1, characterized in that, The target attack library is obtained in the following manner: The initial attack library is constructed using multiple single attack actions; Based on the sensitive features, calculate the feature matching degree between the single attack action and the frequent attack itemset and the temporal matching degree with the abnormal behavior sequence, and delete the single attack action whose feature matching degree or the temporal matching degree exceeds a preset threshold. Add the set of perturbation actions to obtain the target attack library, wherein the set of perturbation actions includes multiple perturbation actions with different perturbation intensities and perturbation locations.

5. The method according to claim 1, characterized in that, The step of executing the attack actions and perturbation actions in the attack action sequence in the stated order to perform attack testing on the target face recognition system includes: The following operation is repeated until the attack action and disturbance action in the attack action sequence pass through the defense: After executing the attack action and perturbation action in the attack action sequence, if the attack action and perturbation action pass the defense, the attack action sequence is output and the loop ends; if the attack action or the perturbation action fails the defense, the attack action sequence is adjusted according to the reinforcement learning parameters in the reinforcement learning algorithm, wherein the reinforcement learning parameters include a state space, an action space, and a reward function. Execute the attack actions and disturbance actions in the adjusted attack action sequence.

6. The method according to claim 5, characterized in that, Adjusting the attack action sequence according to the reinforcement learning parameters in the reinforcement learning algorithm includes: The sensitive features and the defensive features are used as state variables to form the state space; The attack actions in the target attack library are associated with their execution costs to form the action space, wherein the execution cost includes at least one of time cost, resource cost, and business impact cost; The reward function is constructed based on the attack completion degree of the attack action sequence, wherein the attack completion degree is used to optimize the attack action sequence in conjunction with the reward mechanism; The reinforcement learning algorithm filters out suitable attack actions and perturbation actions from the action space based on the state space, and adjusts the corresponding attack actions, perturbation actions, order, and / or execution frequency in the attack action sequence by combining the feedback signal of the reward function, thereby obtaining the adjusted attack action sequence.

7. The method according to claim 1, characterized in that, The sensitive features and defensive features obtained according to the defense rules of the target face recognition system include: The system simulates a user's face-scanning operation to interact with the target face recognition system and collects the execution parameters of the corresponding defense rules. The execution parameters include the feature dimension threshold of the preset face feature matching rule and the timing judgment standard of the attack action interception rule. The sensitive features are obtained by identifying the frequent attack itemset and the abnormal behavior sequence based on the execution parameters. The determination logic of the defense rules is analyzed, and the static detection rules and dynamic behavior verification logic are extracted to obtain the defense features.

8. The method according to claim 1, characterized in that, Also includes: By associating the test results, the corresponding attack sequence, and the defense characteristics, the triggering conditions of the security vulnerability can be obtained. Vulnerability types are classified according to the triggering conditions, wherein the vulnerability types include static detection vulnerabilities, dynamic verification vulnerabilities, or implicit interception vulnerabilities. For the vulnerability type, a remediation direction is determined, wherein the remediation direction includes at least one of the following: supplementing the coverage of the static detection rules, optimizing the anti-disturbance algorithm of the dynamic behavior verification logic, and / or adjusting the interception threshold of the defense feature; The analysis results are output by integrating the triggering conditions, the vulnerability types, and the remediation directions.

9. A face recognition attack testing device, comprising: The feature acquisition module is used to obtain sensitive features and defensive features according to the defense rules of the target face recognition system. The defense rules include preset face feature matching rules and attack action interception rules. The sensitive features include attack frequent itemsets and abnormal behavior sequences. The defensive features include static detection rules and dynamic behavior verification logic. An attack action sequence determination module is used to determine an attack action sequence in a target attack database based on the sensitive features and the defensive features, wherein the target attack database includes a set of attack actions and perturbation actions that do not match the sensitive features, and the attack action sequence includes at least one attack action and at least one perturbation action combined in sequence; and The execution test module is used to execute the attack actions and perturbation actions in the attack action sequence according to the order, so as to perform attack tests on the target face recognition system and obtain test results. The test results characterize the security vulnerabilities existing in the target face recognition system.

10. An electronic device, comprising: One or more processors; Storage device for storing one or more programs. Wherein, when the one or more programs are executed by the one or more processors, the one or more processors perform the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 8.

12. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 8.

Images