Method and system for improving authentication accuracy of MAC address dynamic change scene

Abstract

The invention relates to the technical field of network communication security, in particular to an authentication accuracy improving method and system for an MAC address dynamic change scene, and the method comprises the steps: building and maintaining a mapping database of a terminal identifier and a historical MAC address sequence, collecting a current MAC in real time, querying the database, extracting the historical MAC sequence during matching, and calculating an associated feature index; and constructing a dynamic authentication feature vector by combining equipment attributes and network behavior features, generating a terminal comprehensive identity confidence coefficient through weighted fusion, and deciding to access according to a preset strategy. According to the method, historical MAC sequence association and multi-feature fusion are utilized, and the authentication accuracy in a dynamic scene is improved. According to the invention, the accuracy and continuity of terminal identity discrimination can be improved in a network environment in which MAC addresses frequently change.

Description

Technical Field

[0001] This invention relates to the field of network communication security technology, and in particular to a method and system for improving authentication accuracy in scenarios with dynamically changing MAC addresses. Background Technology

[0002] Current network access authentication relies on the direct binding of static MAC addresses to terminal identifiers, or only verifies whether the current MAC address is in a preset whitelist. When a terminal dynamically changes its MAC address due to system reinstallation, network card replacement, privacy protection settings, or other reasons, the static binding relationship becomes invalid, leading to legitimate terminals being mistakenly rejected or unauthorized terminals using the old MAC address to pass authentication.

[0003] Conventional methods for handling dynamic MAC addresses often rely on frequent updates to static binding tables. However, these methods cannot cover MAC address sequences formed by multiple terminal changes and fail to record the terminal's historical MAC usage history. The authentication process relies solely on a single current MAC address or simple rule matching, ignoring the patterns and associations of a terminal's long-term MAC address usage. Given a current MAC address, existing solutions struggle to determine if it belongs to a set of addresses previously used by a terminal, and cannot combine past MAC address change characteristics with current device attributes and network behavior for correlation analysis. This results in insufficient accuracy in identity recognition in dynamic scenarios and is prone to authentication bias. A mechanism is needed to record the terminal's historical MAC address sequences and match the current MAC address with the terminal identifier. Simultaneously, an authentication basis integrating historical correlation features, device attributes, and network behavior should be constructed to generate identity confidence. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing a method and system for improving authentication accuracy in scenarios with dynamically changing MAC addresses.

[0005] To achieve the above objectives, the present invention employs the following technical solution: a method for improving authentication accuracy in scenarios with dynamically changing MAC addresses, comprising: Establish and maintain a historical mapping database of terminal identifiers and MAC address sequences, wherein the historical mapping database records the association between terminal identifiers and the historical MAC address sequences used by the corresponding terminals; The system collects the current MAC address used by the terminal to be authenticated when initiating a network access request in real time, and queries the historical mapping database based on the current MAC address. When the current MAC address is found to be associated with any terminal identifier in the historical mapping database, the historical MAC address sequence corresponding to the terminal identifier is extracted, and the association feature index between the current MAC address and the historical MAC address sequence is calculated. By combining the device attribute information and network behavior characteristics of the current MAC address, a dynamic authentication feature vector is constructed; The dynamic authentication feature vector is weighted and fused using the associated feature indicators to generate a comprehensive identity confidence score for the terminal. Based on the terminal's overall identity confidence level and combined with preset authentication policy thresholds, an authentication decision is made to grant or deny network access.

[0006] As a further aspect of the present invention, establishing and maintaining a historical mapping database of terminal identifiers and MAC address sequences specifically includes: Data is obtained from and associated with multiple data sources from the identity authentication server, wherein the data sources include at least account login logs, device registration information, and contactless authentication history. Based on the unified user session identifier and device hardware fingerprint information, entity parsing and association matching are performed on the data from the data source to identify multiple historical network access events belonging to the same logical terminal. Extract the terminal identifier and the MAC address used in the corresponding access event from each of the historical network access events. The terminal identifier is a string that uniquely identifies the logical terminal in the system. The extracted MAC addresses are sequentially appended to their corresponding terminal identifiers according to the timestamps at which they were collected, forming key-value pair records with the terminal identifier as the primary key and the time-ordered set of MAC addresses as the values. The MAC address set in the key-value pair record is filtered for timeliness, and only MAC addresses with timestamps within a preset historical time window are retained to form the dynamically updated historical MAC address sequence, and the historical mapping database is persistently stored.

[0007] As a further aspect of the present invention, when a query from the historical mapping database finds that the current MAC address is associated with any terminal identifier, extracting the historical MAC address sequence corresponding to the terminal identifier and calculating the association feature index between the current MAC address and the historical MAC address sequence specifically includes: The current MAC address is matched one by one with the historical MAC address sequence under all terminal identifiers in the historical mapping database. If a match is successful, it is determined that the current MAC address is associated with the matched terminal identifier, and the matched terminal identifier is output as a candidate terminal identifier. Extract the historical MAC address sequence corresponding to the candidate terminal identifier, wherein the historical MAC address sequence contains several MAC addresses collected within a preset historical time window; Calculate the similarity between the current MAC address and each MAC address in the historical MAC address sequence, and count the frequency of MAC addresses with similarity exceeding a preset threshold appearing in the historical MAC address sequence, as the historical frequency index of the current MAC address; Analyze the MAC address change patterns of the historical MAC address sequence and calculate the probability that the current MAC address falls within the range of the next MAC address predicted by the MAC address change pattern, as a pattern conformity index. The historical frequency index is combined with the pattern conformity index to obtain the association feature index.

[0008] As a further aspect of the present invention, the step of constructing a dynamic authentication feature vector by combining the device attribute information and network behavior characteristics of the current MAC address specifically includes: By analyzing the protocol header information carried by the terminal to be authenticated when making an association network access request, the device attribute information is obtained. The device attribute information includes at least the type and version of the operating system, the device manufacturer information, and the network interface type. During the time window from when the network access request is initiated to when the authentication decision is completed, the connection probe behavior, protocol interaction characteristics and traffic rate fluctuations of the terminal to be authenticated at the network layer are continuously collected as the network behavior characteristics. The discrete category information in the device attribute information is processed by one-hot encoding and converted into a numerical vector. The network behavior features are normalized and standardized and converted into numerical vectors with the same scale. The encoded device attribute information vector is concatenated with the standardized network behavior feature vector to form the dynamic authentication feature vector.

[0009] As a further aspect of the present invention, the step of using the associated feature indicators to perform weighted fusion of the dynamic authentication feature vector to generate a comprehensive terminal identity confidence score specifically includes: Design a weight allocation function, using the correlation feature index as the input variable of the weight allocation function; A fusion weight value is calculated using the weight allocation function, and the fusion weight value is positively correlated with the associated feature index. The scalar multiplication operation is performed between the fusion weight value and the dynamic authentication feature vector to obtain the weighted dynamic authentication feature vector; The weighted dynamic authentication feature vector is input into a pre-trained lightweight identity confidence assessment model. The output of the lightweight identity confidence assessment model is a probability value between zero and one. The normalized probability value output by the lightweight identity confidence assessment model is used as the terminal's comprehensive identity confidence.

[0010] As a further aspect of the present invention, the pre-training process of the lightweight identity confidence assessment model is specifically as follows: Collect a dataset containing historical network authentication events as training samples. Each training sample contains historical terminal identifiers, historical dynamic authentication feature vectors, and the real labels of the corresponding authentication events' final manual review or system backtracking confirmation. The training samples are cleaned to remove samples with abnormal feature values ​​or incorrect labels, forming a high-quality benchmark training set. Construct a multilayer perceptron model with one input layer, at least one hidden layer, and one output layer as the initial identity confidence evaluation model; The historical dynamic authentication feature vectors in the benchmark training set are used as the input of the initial identity confidence assessment model, and the corresponding real labels are used as the supervision signals. The weight parameters of the initial identity confidence assessment model are iteratively optimized using the backpropagation algorithm and the gradient descent method. The model is evaluated using an independent validation set during the optimization process. The model performance is monitored using the cross-entropy loss function. Training is stopped when the performance on the validation set tends to stabilize, thus obtaining the final lightweight identity confidence evaluation model.

[0011] As a further aspect of the present invention, the step of making an authentication decision to grant or deny network access based on the terminal's comprehensive identity confidence level and a preset authentication policy threshold specifically includes: The system administrator pre-sets two authentication decision thresholds: a high-confidence permission threshold and a low-confidence rejection threshold; When making authentication decisions, the overall identity confidence level of the terminal is compared with the high confidence permission threshold and the low confidence rejection threshold; If the overall identity confidence level of the terminal is greater than or equal to the high confidence level permission threshold, the identity of the terminal to be authenticated is determined to be legitimate and trustworthy, and a network access permission instruction is directly generated to authorize the terminal to be authenticated to access the target network. If the overall identity confidence level of the terminal is less than or equal to the low confidence rejection threshold, the identity of the terminal to be authenticated is determined to be suspicious or illegal, a network access rejection instruction is generated, the access request of the terminal to be authenticated is rejected, and the corresponding event may be selectively recorded to the audit log. If the overall identity confidence level of the terminal is between the low confidence rejection threshold and the high confidence permission threshold, it is determined that further verification is required, and an auxiliary authentication process is triggered.

[0012] As a further aspect of the present invention, the triggering of the auxiliary authentication process specifically includes: Send a notification message containing a time-sensitive temporary token to the terminal to be authenticated or its associated user account, the notification message being sent via a backup communication channel; Start a timer to listen for responses from the terminal to be authenticated within a preset validity period. The responses must contain the correct time-sensitive temporary token. If a response containing the correct token is received within the validity period, the auxiliary authentication is considered successful, the overall identity confidence of the terminal is adjusted upwards, and the authentication decision process is re-executed based on the adjusted confidence. If no response is received within the validity period or the received token is incorrect, the auxiliary authentication is considered to have failed. The overall identity confidence of the terminal is then adjusted downwards, and the authentication decision process is re-executed based on the adjusted confidence, or access is directly denied. Regardless of whether the assisted authentication is successful or not, the complete feature vector, confidence value, and final decision result of this decision will be recorded in the historical mapping database for subsequent model training and database updates.

[0013] As a further aspect of the present invention, after completing the authentication decision, an incremental update step of the historical mapping database is also included: Record the process data of this authentication event. The process data includes at least the terminal identifier of the terminal to be authenticated, the current MAC address, the dynamic authentication feature vector, the terminal's comprehensive identity confidence level, and the final authentication decision result. Based on the final authentication decision, this authentication event will be classified as a successful authentication event or a failed authentication event. For a successful authentication event, the current MAC address used in this authentication is used as a new data point and inserted into the historical MAC address sequence corresponding to the terminal identifier according to its timestamp, and the oldest data point in the historical MAC address sequence is removed to keep the sequence length constant. For failed authentication events, the association between the terminal identifier and the current MAC address is analyzed to determine whether it is suspicious. If it is determined to be a malicious forgery or fraudulent association, the current MAC address is added to a shared blacklist of abnormal MAC addresses, and the historical mapping database is notified to globally block the current MAC address.

[0014] As a further aspect of the present invention, when the processor executes the computer program, it implements the steps of the method for improving authentication accuracy in scenarios with dynamically changing MAC addresses as described above.

[0015] Compared with the prior art, the advantages and positive effects of the present invention are as follows: A historical mapping database of terminal identifiers and historical MAC address sequences is established. The current MAC address is collected in real time and queried from this database. When a match is found, the corresponding historical MAC address sequence is extracted and the association feature index is calculated. This approach allows the current MAC address to be associated with multiple MAC addresses previously used by the terminal, overcoming the limitations of static binding to a single MAC address. This enables authentication to detect changes in the terminal's MAC address, allowing for terminal identification based on historical usage relationships even when the MAC address changes dynamically. This reduces identification interruptions caused by MAC address changes and enhances the continuous identification capability for terminals with multiple MAC address changes.

[0016] Historical MAC address sequences are extracted to calculate correlation feature indicators. These are then combined with current MAC address device attribute information and network behavior characteristics to construct a dynamic authentication feature vector. Weighted fusion of these correlation feature indicators generates a comprehensive terminal identity confidence score. This approach integrates historical MAC address correlation patterns, hardware attributes, and dynamic network behavior into a single authentication framework, forming a multi-dimensional and quantifiable basis for identity determination. This avoids one-sided judgments relying solely on the current MAC address or a single attribute. Through the weighting of correlation feature indicators, features of different dimensions influence the final confidence score according to their closeness to historical relationships. This makes the authentication results more closely reflect the actual continuity of the terminal's identity, improving the detail and discriminative power of identity determination in scenarios with dynamically changing MAC addresses. Attached Figure Description

[0017] Figure 1 This is a flowchart of the method for improving authentication accuracy in scenarios with dynamically changing MAC addresses, as described in this invention. Figure 2 A flowchart for constructing dynamic authentication feature vectors; Figure 3 A graph showing the collaborative evolution of time consumption and accuracy at each stage of dynamic MAC address authentication; Figure 4 A dynamic trend chart showing the correlation between network access authentication requests, the number of successful requests, and the success rate. Figure 5 A heatmap showing the correlation coefficients between dynamic features and the fused confidence level in a MAC address dynamic authentication scenario. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0019] In the description of this invention, it should be understood that the terms "length," "width," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," and "outer," etc., indicating orientation or positional relationships, are based on the orientation or positional relationships shown in the accompanying drawings and are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, in the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0020] See Figure 1 The method for improving authentication accuracy in scenarios with dynamically changing MAC addresses, as described in this invention, includes the following steps: establishing and maintaining a historical mapping database of terminal identifiers and MAC address sequences, which records the association between terminal identifiers and the historical MAC address sequences used by the corresponding terminals; real-time collection of the current MAC address used by the terminal to be authenticated when initiating a network access request, and querying the historical mapping database based on the current MAC address; when a correlation is found between the current MAC address and any terminal identifier in the historical mapping database, extracting the historical MAC address sequence corresponding to the terminal identifier, and calculating the correlation feature index between the current MAC address and the historical MAC address sequence; constructing a dynamic authentication feature vector by combining the device attribute information and network behavior characteristics of the current MAC address; weighting and fusing the dynamic authentication feature vector using the correlation feature index to generate a comprehensive terminal identity confidence score; and making an authentication decision to grant or deny network access based on the comprehensive terminal identity confidence score and a preset authentication policy threshold.

[0021] In one embodiment of the present invention, data from multiple data sources are obtained and associated from an identity authentication server. These data sources include at least account login logs, device registration information, and seamless authentication history. Based on a unified user session identifier and device hardware fingerprint information, entity parsing and association matching are performed on the data from the data sources to identify multiple historical network access events belonging to the same logical terminal. A terminal identifier and the MAC address used in the corresponding access event are extracted from each historical network access event. The terminal identifier is a string that uniquely identifies the logical terminal in the system. The extracted MAC addresses are sequentially appended to their corresponding terminal identifiers according to their timestamps, forming key-value pair records with the terminal identifier as the primary key and the time-ordered set of MAC addresses as the values. The MAC address sets in the key-value pair records are filtered for timeliness, retaining only MAC addresses with timestamps within a preset historical time window, forming a dynamically updated historical MAC address sequence, and the historical mapping database is persistently stored.

[0022] In practical implementation, the method for improving authentication accuracy in scenarios with dynamically changing MAC addresses involves establishing and maintaining a historical mapping database of terminal identifiers and MAC address sequences. This is achieved by integrating multi-source logs with execution entity association matching. An example scenario involves an enterprise wireless network environment where the identity authentication server continuously receives data from multiple data sources, including enterprise wireless controller logs, Virtual Private Network (VPN) gateway session records, and Dynamic Host Configuration Protocol (DHCP) server allocation records. Among these data sources, account login logs originate from the enterprise's unified identity management platform, device registration information comes from the Mobile Device Management (MDN) system's entry records, and seamless authentication history records come from the Network Access Control (NAC) system's successful access records in past authentication cycles. This data is transmitted in real-time or periodically to the background service process responsible for building the historical mapping database.

[0023] In some embodiments, the background service process performs entity parsing and association matching on multi-source data based on a unified user session identifier and device hardware fingerprint information. The user session identifier is a globally unique string used in Single Sign-On (SSO) processes, while the device hardware fingerprint information is generated by collecting and hashing a combination of terminal attributes, such as the combined hash value of the International Mobile Equipment Identity (IMEI), device serial number, and motherboard identifier. The entity parsing process scans all data sources, clustering log entries containing the same user session identifier or the same device hardware fingerprint information to identify multiple historical network access events belonging to the same logical terminal. For example, a connection record from a wireless controller, a tunnel establishment record from a VPN gateway, and an authentication record from an NAC system might be associated as three different network access events for the same laptop within a day using shared device hardware fingerprint information.

[0024] It is understandable that from each identified historical network access event, the system extracts two core fields: terminal identifier and MAC address. The terminal identifier is a system-generated string uniquely identifying a logical terminal; its generation rule could be concatenating the username with the device hardware fingerprint hash value and then hashing it again. The extracted MAC address is the media access control address actually used by the terminal in that specific historical network access event. All extracted "terminal identifier-MAC address" pairs are sorted according to the timestamp at which the MAC address was collected.

[0025] Optionally, the system organizes the sorted data into key-value pair records with the terminal identifier as the primary key. For each terminal identifier, its corresponding value is a time-ordered set of MAC addresses. This set records all observed MAC addresses of the logical terminal represented by that terminal identifier within a past period and their occurrence times. This process can be implemented using an in-memory hash table combined with a time-series database. The key of the hash table is the terminal identifier string, and the value is a linked list or array sorted in ascending order of timestamps. Each node in the linked list stores a MAC address string and its corresponding timestamp.

[0026] In practice, time-sensitive filtering of the MAC address set in key-value pair records is a crucial operation for maintaining database validity. The system presets a historical time window, such as 30 days. The maintenance process periodically scans the time-ordered MAC address set in each record, removing all MAC address nodes whose timestamps are earlier than the current time minus the historical time window (e.g., 30 days). After filtering, the remaining MAC address nodes constitute the dynamically updated historical MAC address sequence for that terminal identifier. For example, a terminal identifier's MAC address set originally contained 5 different MAC addresses used in the past 60 days; after time-sensitive filtering with a 30-day window, it may only retain 3 MAC addresses used in the most recent 30 days as its current historical MAC address sequence. Finally, the historical mapping database, after entity association, data extraction, ordered organization, and time-sensitive filtering, is persistently stored in a relational database or distributed file system for subsequent real-time queries.

[0027] See Figure 2 In one embodiment of the present invention, the current MAC address is matched one by one with the historical MAC address sequences under all terminal identifiers in the historical mapping database. If a match is successful, it is determined that the current MAC address is associated with the matched terminal identifier, and the matched terminal identifier is output as a candidate terminal identifier. The historical MAC address sequence corresponding to the candidate terminal identifier is extracted. This historical MAC address sequence contains several MAC addresses collected within a preset historical time window. The similarity between the current MAC address and each MAC address in the historical MAC address sequence is calculated, and the frequency of MAC addresses with similarity exceeding a preset threshold appearing in the historical MAC address sequence is counted as the historical occurrence frequency index of the current MAC address. The MAC address change patterns of the historical MAC address sequence are analyzed, and the probability that the current MAC address falls within the range of the next MAC address predicted by the MAC address change pattern is calculated as the pattern conformity index. The historical occurrence frequency index and the pattern conformity index are combined to obtain the association feature index.

[0028] By analyzing the protocol header information carried by the terminal to be authenticated when making a network access request, device attribute information is obtained. This device attribute information includes at least the type and version of the operating system, the device manufacturer information, and the network interface type. Within the time window from the initiation of the network access request to the completion of the authentication decision, the connection probe behavior, protocol interaction characteristics, and traffic rate fluctuations of the terminal to be authenticated at the network layer are continuously collected as network behavior features. The discrete category information in the device attribute information is one-hot encoded and converted into a numerical vector. The network behavior features are normalized and standardized, converting them into numerical vectors with the same scale. The encoded device attribute information vector and the standardized network behavior feature vector are concatenated to form a dynamic authentication feature vector.

[0029] In practical implementation, the method for improving authentication accuracy in scenarios with dynamically changing MAC addresses involves multi-stage data processing and feature engineering to calculate associated feature indicators and construct dynamic authentication feature vectors. An example scenario involves a campus network access point where the real-time collected MAC address of the terminal to be authenticated is "00:1A:2B:3C:4D:5E". After querying the historical mapping database, the terminal identifier "USER123_DEV456" is matched. The historical MAC address sequence corresponding to this terminal identifier is extracted, containing five MAC address entries from the past seven days: "00:1A:2B:3C:4D:50", "00:1A:2B:3C:4D:51", "00:1A:2B:3C:4D:52", "00:1A:2B:3C:4D:53", and "00:1A:2B:3C:4D:54". Each entry is accompanied by a timestamp accurate to the second.

[0030] In some embodiments, the current MAC address "00:1A:2B:3C:4D:5E" is matched one by one with the historical MAC address sequences under all terminal identifiers in the historical mapping database. The matching process uses a string exact comparison algorithm. If an identical MAC address string is found in the historical MAC address sequence of the current terminal identifier "USER123_DEV456", the match is considered successful and "USER123_DEV456" is output as a candidate terminal identifier. The historical MAC address sequence corresponding to the candidate terminal identifier is extracted. This sequence is strictly limited to a preset historical time window, such as 168 hours, and contains five MAC address strings arranged in ascending order of timestamp. The similarity between the current MAC address and each MAC address in the historical MAC address sequence is calculated. The similarity calculation uses a normalization algorithm based on character edit distance. The frequency of MAC addresses with a similarity exceeding a preset threshold of 0.8 in the historical MAC address sequence is counted. For example, if three historical MAC addresses have a similarity exceeding 0.8 with the current MAC address, the historical occurrence frequency index is recorded as 3.

[0031] It's understandable that analyzing MAC address change patterns in historical MAC address sequences involves converting MAC address strings into numerical sequences. For example, converting the last two hexadecimal characters of each MAC address into decimal values. The historical numerical sequence is [80, 81, 82, 83, 84]. A linear regression model is then applied to predict the range of values ​​for the next MAC address. The probability that the current MAC address value 94 falls within the predicted range is calculated as a pattern conformity index. The formula for calculating the pattern conformity index is: in: Indicates the pattern conformity index. This represents the decimal value of the current MAC address. This represents the next MAC address value predicted by the linear regression model. This represents the standard deviation of the historical MAC address numerical sequence. The historical frequency index and the pattern conformity index are linearly combined; for example, the historical frequency index is weighted at 0.6 and the pattern conformity index at 0.4, and the sum is obtained to obtain the correlation feature index.

[0032] In practice, a dynamic authentication feature vector is constructed by combining the device attribute information of the current MAC address with network behavior characteristics. Deep packet inspection technology is used to analyze protocol header information such as Transmission Control Protocol (TCP) synchronization messages and Hypertext Transfer Protocol (HTTP) request headers sent by the terminal to be authenticated during network access requests. Device attribute information is obtained, including operating system type "Android", operating system version "11", device manufacturer information "Samsung", and network interface type "802.11ac". Within a time window (e.g., 5 seconds) between the initiation of the network access request and the completion of the authentication decision, the connection probe behavior of the terminal to be authenticated at the network layer is continuously collected. This includes the frequency of sending Internet Control Message Protocol (ICP) echo requests to the gateway, protocol interaction characteristics such as the content of the parameter request list in Dynamic Host Configuration Protocol (DHCP) interactions, and traffic rate fluctuations such as the variance of bytes transmitted per second. These are used as network behavior characteristics.

[0033] Optionally, the discrete category information in the device attribute information is processed using one-hot encoding. The operating system type "Android" is encoded as [1,0], the operating system version "11" as [0,1,0,0,…] (based on the version dictionary size), the device manufacturer information "Samsung" as [0,0,1,0,…], and the network interface type "802.11ac" as [0,1]. These are then concatenated to form a device attribute information numerical vector. Network behavior features are then processed using min-max normalization and Z-score standardization. The connection probe behavior frequency is normalized to the [0,1] interval, the protocol interaction features are vectorized and then standardized, and the traffic rate fluctuation is logarithmically normalized to form a network behavior feature numerical vector with the same scale. The device attribute information vector processed by one-hot encoding is then directly concatenated with the standardized network behavior feature vector. For example, if the device attribute information vector has a length of 50 and the network behavior feature vector has a length of 30, the dynamic authentication feature vector is a one-dimensional numerical array of length 80.

[0034] In some embodiments, the construction of dynamic authentication feature vectors and the calculation of associated feature indicators are performed in parallel. The calculation of associated feature indicators relies on real-time query results from the historical mapping database, while the construction of dynamic authentication feature vectors relies on real-time collected network traffic and protocol parsing. It can be understood that the dynamic authentication feature vectors, as input for subsequent weighted fusion, must strictly match the input layer structure of the pre-trained lightweight identity confidence assessment model in terms of dimension and content. The device attribute information vector corresponds to the first 50 neurons of the model input, and the network behavior feature vector corresponds to the last 30 neurons of the model input, ensuring data format consistency.

[0035] In one embodiment of the present invention, a weight allocation function is designed, with the associated feature index as the input variable. A fusion weight value is calculated through the weight allocation function, and the fusion weight value is positively correlated with the associated feature index. The fusion weight value is multiplied by a dynamic authentication feature vector to obtain a weighted dynamic authentication feature vector. The weighted dynamic authentication feature vector is input into a pre-trained lightweight identity confidence assessment model. The output of the lightweight identity confidence assessment model is a probability value between zero and one. The normalized probability value output by the model is used as the terminal's comprehensive identity confidence.

[0036] A dataset containing historical network authentication events is collected as training samples. Each training sample includes historical terminal identifiers, historical dynamic authentication feature vectors, and the corresponding real labels from the final manual review or system backtracking confirmation of the authentication event. The training samples are cleaned to remove samples with abnormal feature values ​​or incorrect labels, forming a high-quality benchmark training set. A multilayer perceptron model with one input layer, at least one hidden layer, and one output layer is constructed as the initial identity confidence assessment model. The historical dynamic authentication feature vectors from the benchmark training set are used as input to the initial identity confidence assessment model, and the corresponding real labels are used as supervision signals. The weight parameters of the initial identity confidence assessment model are iteratively optimized using backpropagation and gradient descent. The model is evaluated using an independent validation set during the optimization process. The model performance is monitored using the cross-entropy loss function. Training stops when the performance on the validation set stabilizes, resulting in the final lightweight identity confidence assessment model.

[0037] In practical implementation, the method for improving authentication accuracy in scenarios with dynamically changing MAC addresses generates the terminal comprehensive identity confidence level by designing a weight allocation function and calling a pre-trained model. An example scenario involves an edge access point of a cloud computing data center. The terminal to be authenticated has calculated the value of the associated feature index Γ to be 0.72. The dynamic authentication feature vector V is a one-dimensional floating-point array of length 200.

[0038] In some embodiments, a weight allocation function is designed, taking the associated feature index Γ as the sole input variable. The weight allocation function uses a sigmoid function for mathematical mapping, and a fusion weight value ω is calculated through the weight allocation function. The fusion weight value ω is positively correlated with the associated feature index Γ. The specific functional relationship is expressed as follows: in: Indicates the fusion weight value. Indicates correlation characteristic indicators, Represents the natural constant. and These are preset adjustable parameters used to control the slope and offset of the function curve, for example, setting parameters. 5.0, parameters The value is -3.0. The fusion weight value will be... Perform scalar multiplication with the dynamic authentication feature vector V, that is, multiply each element of vector V by a scalar. We obtain the weighted dynamic authentication feature vector V'.

[0039] It can be understood that the weighted dynamic authentication feature vector V' is input into a pre-trained lightweight identity confidence assessment model. This model is a pre-trained forward propagation computation graph with fixed parameters. The input layer of this model has 200 neurons to match the length of the vector V', and the output layer consists of a single sigmoid neuron, whose output value is a probability value P between 0 and 1. The probability value P output by the lightweight identity confidence assessment model is then normalized and used as the terminal's overall identity confidence. In this scenario, normalization specifically refers to directly mapping the probability value P to the confidence level C, i.e., C = P.

[0040] In practice, the pre-training process of the lightweight identity confidence assessment model is completed by collecting historical data offline and iteratively optimizing model parameters. A dataset containing historical network authentication events is collected as training samples. Each training sample is a triplet data structure, which contains a historical terminal identifier string, a historical dynamic authentication feature vector array, and the binary value of the real label of the corresponding authentication event, which is ultimately confirmed by manual review or system backtracking (0 indicates illegal or fraudulent, and 1 indicates legal). The training samples are cleaned according to the following rules: samples containing null values ​​or values ​​outside the reasonable range in the historical dynamic authentication feature vector array are removed, as are samples where the real label and the historical terminal identifier are obviously contradictory, such as the same historical terminal identifier having completely opposite labels in a very short period of time, thus forming a high-quality benchmark training set.

[0041] Optionally, a multilayer perceptron model with one input layer, at least one hidden layer, and one output layer is constructed as the initial identity confidence assessment model. For example, the input layer dimension is 200, the two hidden layers have dimensions of 128 and 64 respectively, and the output layer dimension is 1. The hidden layers use the modified linear unit activation function. The historical dynamic authentication feature vector array in the benchmark training set is used as the input to the initial identity confidence assessment model, and the corresponding real label binary values ​​are used as the supervision signal. The weight parameters of the initial identity confidence assessment model are iteratively optimized using the backpropagation algorithm and stochastic gradient descent. In each iteration, a mini-batch of samples is sampled from the training set to calculate the gradient of the loss function and update the model parameters.

[0042] In some embodiments, an independent validation set is used to evaluate the model during the optimization process. The validation set is a subset of data from the historical dataset that was not used in training. The model performance is monitored using a cross-entropy loss function, which calculates the difference between the model's predicted probability and the true label. When the cross-entropy loss function value on the validation set no longer decreases significantly over several consecutive training epochs, the model performance is considered to have stabilized, and training is stopped. The final lightweight identity confidence evaluation model is obtained, and its weight parameters are persistently saved and deployed to the online authentication system.

[0043] See Figure 3 The data visually illustrates the synergistic relationship between the time consumed in each stage and the authentication accuracy. In the overall process, the model training stage takes the longest, reaching 45 minutes. This stage forms the foundation for subsequent high accuracy. By constructing a historical mapping database and training a lightweight identity confidence assessment model, it provides the core computational foundation and model support for subsequent stages. The authentication accuracy at this stage is 0.82, representing the initial improvement phase of the process. The online authentication stage takes 20 minutes, completing real-time matching based on the pre-trained model and the historical mapping database, improving the accuracy to 0.88. The weight calculation stage takes 8 minutes, using a weight allocation function to weight and fuse dynamic authentication feature vectors, further increasing the accuracy to 0.90. The confidence assessment stage takes 10 minutes, inputting the weighted feature vectors into the model to generate the terminal's comprehensive identity confidence, achieving an accuracy of 0.94. The database update stage takes 12 minutes, maintaining the timeliness of the historical mapping database through incremental updates, ultimately stabilizing the authentication accuracy at 0.95. It is worth noting that time consumption and accuracy show a clear positive correlation: the early basic construction stage (such as model training) takes a long time but the accuracy improvement is relatively slow, while the later real-time calculation and evaluation stage (such as weight calculation and confidence evaluation) takes less time but the accuracy improvement rate is faster. This feature is consistent with the engineering logic of "offline training-online inference-dynamic update" in the dynamic authentication process, and also verifies the balance design between efficiency and accuracy of this method.

[0044] In one embodiment of the present invention, the system administrator pre-sets two authentication decision thresholds: a high-confidence permission threshold and a low-confidence rejection threshold. During authentication decision-making, the overall identity confidence of the terminal is compared with both the high-confidence permission threshold and the low-confidence rejection threshold. If the overall identity confidence of the terminal is greater than or equal to the high-confidence permission threshold, the terminal to be authenticated is deemed legitimate and trustworthy, and a network access permission command is directly generated, authorizing the terminal to access the target network. If the overall identity confidence of the terminal is less than or equal to the low-confidence rejection threshold, the terminal to be authenticated is deemed suspicious or illegitimate, a network access rejection command is generated, rejecting the access request of the terminal to be authenticated, and the corresponding event may be selectively recorded in the audit log. If the overall identity confidence of the terminal is between the low-confidence rejection threshold and the high-confidence permission threshold, further verification is required, triggering an auxiliary authentication process.

[0045] A notification message containing a time-sensitive temporary token is sent to the terminal to be authenticated or its associated user account via a backup communication channel. A timer is started to listen for responses from the terminal to be authenticated within a preset validity period. These responses must contain the correct time-sensitive temporary token. If a response containing the correct token is received within the validity period, the auxiliary authentication is considered successful. The terminal's overall identity confidence level is adjusted upwards, and the authentication decision process is re-executed based on the adjusted confidence level. If no response is received within the validity period or the received token is incorrect, the auxiliary authentication is considered to have failed. The terminal's overall identity confidence level is adjusted downwards, and the authentication decision process is re-executed based on the adjusted confidence level, or access is directly denied. Regardless of whether the auxiliary authentication succeeds or fails, the complete feature vector, confidence value, and final decision result are recorded in the historical mapping database for subsequent model training and database updates.

[0046] In practical implementation, the authentication accuracy improvement method for scenarios with dynamically changing MAC addresses makes authentication decisions on network access permission or denial based on comparison and judgment of preset thresholds. An example scenario involves the internal network access control system of a medical institution. The system administrator presets two authentication decision thresholds: a high confidence permission threshold of 0.75 and a low confidence denial threshold of 0.40. The calculated comprehensive identity confidence of the terminal to be authenticated is 0.65.

[0047] In some embodiments, during authentication decisions, the authentication engine compares the terminal's overall identity confidence score (0.65) with a high-confidence permission threshold (0.75) and a low-confidence rejection threshold (0.40), following the rules shown in Table 1. If the terminal's overall identity confidence score is greater than or equal to the high-confidence permission threshold, the terminal to be authenticated is deemed legitimate and trustworthy. A network access permission instruction is directly generated, authorizing the terminal to access the target network. The network access permission instruction is then sent to the network switch or wireless access point to perform port opening or permission granting operations. If the terminal's overall identity confidence score is less than or equal to the low-confidence rejection threshold, the terminal to be authenticated is deemed suspicious or illegitimate. A network access rejection instruction is generated, rejecting the terminal's access request. The network access rejection instruction can trigger the network device to discard subsequent data packets from the terminal and may selectively record the terminal identifier, current MAC address, rejection reason, and timestamp in the audit log. See Table 1.

[0048] Table 1: Authentication Decision Thresholds and Corresponding Operation Table Understandably, in this example, the terminal's overall identity confidence level of 0.65 falls between the low-confidence rejection threshold of 0.40 and the high-confidence permission threshold of 0.75. The system determines that further verification is needed and triggers an auxiliary authentication process. This auxiliary authentication process is implemented through a multi-channel verification mechanism, sending a notification message containing a time-sensitive temporary token to the terminal to be authenticated or its associated user account. The time-sensitive temporary token is a 6-digit code generated by a pseudo-random number generator and valid for 120 seconds. The notification message is sent via alternative communication channels, such as a bound mobile phone SMS or a verified email address.

[0049] In practice, a timer is started, listening for responses from the terminal to be authenticated within a preset 120-second validity period. The response requires the user to enter a correct time-sensitive temporary token on the terminal via a pop-up authentication page or a dedicated application. If a response containing a correct 6-digit numeric token is received within the 120-second validity period, the auxiliary authentication is considered successful, and the terminal's overall identity confidence level is adjusted upwards using the following formula: ,in: C represents the corrected overall terminal identity confidence level, and C represents the original overall terminal identity confidence level. This represents a fixed upward correction amount, such as 0.15, based on the corrected confidence level. The authentication decision process is re-executed. If no response is received within the 120-second validity period or the received 6-digit digital token is incorrect, the auxiliary authentication is considered to have failed, and the terminal's overall identity confidence level is adjusted downwards using the following formula: ,in: C represents the corrected overall terminal identity confidence level, and C represents the original overall terminal identity confidence level. This represents a fixed downward correction amount, such as 0.20, based on the corrected confidence level. The authentication decision process will be re-executed or access will be denied outright.

[0050] Optionally, regardless of whether the assisted authentication is successful or not, the system will record the complete dynamic authentication feature vector, the terminal's comprehensive identity confidence value, and the final decision result to the historical mapping database for subsequent training of the lightweight identity confidence evaluation model and updating of the historical mapping database. The recorded data structure includes timestamp, terminal identifier, feature vector array, confidence floating-point number, decision result string, and assisted authentication process log.

[0051] See Figure 4 Through the interconnected presentation of multi-dimensional indicators, the dynamic patterns of network access behavior in medical scenarios are clearly depicted. The graph uses a 24-hour time axis as the horizontal axis, with the left vertical axis quantifying the absolute number of authentication requests and successful authentications, and the right vertical axis representing the relative percentage of authentication success rate. The blue curve represents the number of authentication requests, exhibiting a periodic fluctuation of "two peaks and two troughs": the first peak occurs around 7:00 AM, corresponding to the morning shift handover and concentrated equipment deployment peak in medical institutions; the second peak occurs around 5:00 PM, highly consistent with the afternoon's reuse of diagnostic equipment and mobile terminal access behavior. The green curve represents the number of successful authentications, its fluctuation trend highly coupled with the number of authentication requests, reflecting the response efficiency of the basic authentication mechanism. The red curve represents the authentication success rate, maintaining a high confidence level of over 85% in the morning (6-9:00 AM) and evening (2-6:00 PM), directly related to the high credibility of device identity during the core business hours of medical institutions; however, a significant trough appears around 2:00 AM, revealing the impact of unauthorized exploratory access behavior at night on the authentication system.

[0052] In one embodiment of the present invention, process data for this authentication event is recorded. This process data includes at least the terminal identifier of the terminal to be authenticated, the current MAC address, the dynamic authentication feature vector, the terminal's comprehensive identity confidence level, and the final authentication decision result. Based on the final authentication decision result, this authentication event is classified as a successful authentication event or a failed authentication event. For a successful authentication event, the current MAC address used in this authentication is treated as a new data point and inserted into the historical MAC address sequence corresponding to the terminal identifier according to its timestamp. The oldest data point in the historical MAC address sequence is removed to maintain a constant sequence length. For a failed authentication event, the association between the terminal identifier and the current MAC address is analyzed to determine if it is suspicious. If it is determined to be a malicious forgery or fraudulent association, the current MAC address is added to a shared abnormal MAC address blacklist, and the historical mapping database is notified to globally block the current MAC address.

[0053] In practical implementation, the incremental update step of the historical mapping database in the method for improving authentication accuracy in scenarios with dynamically changing MAC addresses occurs after each network access authentication decision is completed. An example scenario involves a boundary firewall of an enterprise office network completing an authentication decision. The terminal to be authenticated is identified as "EMP_789_XPTO", and the current MAC address used for this authentication is "AA:BB:CC:DD:EE:FF". The calculated comprehensive identity confidence of the terminal is 0.82, and the final authentication decision result is "access permitted".

[0054] In some embodiments, the process data of this authentication event is recorded. This process data is encapsulated into a structured log entry. The log entry includes at least the terminal identifier string "EMP_789_XPTO" of the terminal to be authenticated, the current MAC address string "AA:BB:CC:DD:EE:FF", a dynamic authentication feature vector array (a floating-point array of length 150), the terminal's comprehensive identity confidence level (floating-point number 0.82), and the final authentication decision result string "Permitted Access". The system classifies this authentication event as a successful authentication event or a failed authentication event based on the final authentication decision result string. In this scenario, the decision result string is "Permitted Access", therefore the event is classified as a successful authentication event.

[0055] Understandably, for a successful authentication event, the system uses the current MAC address "AA:BB:CC:DD:EE:FF" used in this authentication as a new data point. This new data point contains the MAC address string and the current timestamp, and is inserted into the historical MAC address sequence corresponding to the terminal identifier "EMP_789_XPTO" according to its timestamp. The insertion operation must maintain the temporal order of the historical MAC address sequence. In specific implementation, to ensure the length of the historical MAC address sequence remains constant to control storage overhead and computational complexity, the system simultaneously removes the oldest data point from the historical MAC address sequence. The constant length value K is preset by the system, for example, K=100. The update operation can be expressed by the formula: Ω=min(5,K), where Ω represents the number of the oldest data points removed from the end of the sequence, min represents the minimum value function, the constant 5 represents a safe removal step size to prevent the sequence from becoming too long, and K represents the preset constant sequence length value. The updated historical MAC address sequence will serve as the basis for querying the terminal identifier during the next authentication.

[0056] For failed authentication events, the analysis examines whether the association between the terminal identifier and the current MAC address is suspicious. Failed authentication events specifically refer to those where the final authentication decision is "access denied" and auxiliary authentication also fails. The analysis process retrieves past authentication records for the terminal identifier "EMP_789_XPTO" and checks whether the current MAC address "AA:BB:CC:DD:EE:FF" appears for the first time under this identifier. This is combined with anomalies in the dynamic authentication feature vector during the current authentication process. If it is determined to be a malicious forgery or fraudulent association, the current MAC address string "AA:BB:CC:DD:EE:FF" is added to a shared blacklist of abnormal MAC addresses. This shared blacklist is stored in a centralized, distributed database accessible to all authentication nodes.

[0057] Optionally, the system instructs the historical mapping database to globally block the current MAC address "AA:BB:CC:DD:EE:FF". This global blocking means that in any subsequent authentication request, if this MAC address is detected, the historical mapping database will directly return an unrelated result, thus preventing further historical association queries based on this malicious MAC address. In some embodiments, the incremental update step is executed as an asynchronous background task with lower priority than the real-time authentication decision process to ensure timely authentication responses. Sequence updates for successful authentication events and blacklist updates for failed authentication events are both recorded in separate operation logs for auditing purposes.

[0058] See Figure 5The figure shows the distribution of Pearson correlation coefficients between various dynamic features and the fused confidence level. The horizontal and vertical dimensions of the figure include four categories of indicators: the mean of device attribute features, the mean of network behavior features, the mean of MAC association features, and the fused confidence level. The colors change from dark green to dark red, corresponding to the correlation coefficients ranging from 1.00 to -1.00, intuitively reflecting the strength and direction of the linear association between variables. Numerically, the associations between the three types of dynamic features and the fused confidence level are all weak: the mean of device attribute features shows a weak negative correlation (-0.057), the mean of network behavior features shows a very weak positive correlation (0.017), and the correlation coefficient between the mean of MAC association features and the fused confidence level is only -0.0035, indicating that the linear explanatory power of a single dynamic feature on the fused confidence level is limited. Furthermore, the mean values ​​of network behavior features and MAC association features showed a moderate negative correlation (-0.26), reflecting a certain degree of information complementarity between the two types of features in the identity authentication scenario. Meanwhile, the mean values ​​of device attribute features and MAC association features showed a weak positive correlation (0.11), suggesting that there may be a weak synergistic association between the two.

[0059] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A method for improving authentication accuracy in scenarios with dynamically changing MAC addresses, characterized in that, Includes the following steps: Establish and maintain a historical mapping database of terminal identifiers and MAC address sequences, wherein the historical mapping database records the association between terminal identifiers and the historical MAC address sequences used by the corresponding terminals; The system collects the current MAC address used by the terminal to be authenticated when initiating a network access request in real time, and queries the historical mapping database based on the current MAC address. When the current MAC address is found to be associated with any terminal identifier in the historical mapping database, the historical MAC address sequence corresponding to the terminal identifier is extracted, and the association feature index between the current MAC address and the historical MAC address sequence is calculated. By combining the device attribute information and network behavior characteristics of the current MAC address, a dynamic authentication feature vector is constructed; The dynamic authentication feature vector is weighted and fused using the associated feature indicators to generate a comprehensive identity confidence score for the terminal. Based on the terminal's overall identity confidence level and combined with preset authentication policy thresholds, an authentication decision is made to grant or deny network access.

2. The method for improving authentication accuracy in scenarios with dynamically changing MAC addresses according to claim 1, characterized in that, The establishment and maintenance of a historical mapping database between terminal identifiers and MAC address sequences specifically involves: Data is obtained from and associated with multiple data sources from the identity authentication server, wherein the data sources include at least account login logs, device registration information, and contactless authentication history. Based on the unified user session identifier and device hardware fingerprint information, entity parsing and association matching are performed on the data from the data source to identify multiple historical network access events belonging to the same logical terminal. Extract the terminal identifier and the MAC address used in the corresponding access event from each of the historical network access events. The terminal identifier is a string that uniquely identifies the logical terminal in the system. The extracted MAC addresses are sequentially appended to their corresponding terminal identifiers according to the timestamps at which they were collected, forming key-value pair records with the terminal identifier as the primary key and the time-ordered set of MAC addresses as the values. The MAC address set in the key-value pair record is filtered for timeliness, and only MAC addresses with timestamps within a preset historical time window are retained to form the dynamically updated historical MAC address sequence, and the historical mapping database is persistently stored.

3. The method for improving authentication accuracy in scenarios with dynamically changing MAC addresses according to claim 2, characterized in that, When a query from the historical mapping database finds that the current MAC address is associated with any terminal identifier, the process of extracting the historical MAC address sequence corresponding to the terminal identifier and calculating the association feature index between the current MAC address and the historical MAC address sequence specifically includes: The current MAC address is matched one by one with the historical MAC address sequence under all terminal identifiers in the historical mapping database. If a match is successful, it is determined that the current MAC address is associated with the matched terminal identifier, and the matched terminal identifier is output as a candidate terminal identifier. Extract the historical MAC address sequence corresponding to the candidate terminal identifier, wherein the historical MAC address sequence contains several MAC addresses collected within a preset historical time window; Calculate the similarity between the current MAC address and each MAC address in the historical MAC address sequence, and count the frequency of MAC addresses with similarity exceeding a preset threshold appearing in the historical MAC address sequence, as the historical frequency index of the current MAC address; Analyze the MAC address change patterns of the historical MAC address sequence and calculate the probability that the current MAC address falls within the range of the next MAC address predicted by the MAC address change pattern, as a pattern conformity index. The historical frequency index is combined with the pattern conformity index to obtain the association feature index.

4. The method for improving authentication accuracy in scenarios with dynamically changing MAC addresses according to claim 1, characterized in that, The process of constructing a dynamic authentication feature vector by combining the device attribute information and network behavior characteristics of the current MAC address is as follows: By analyzing the protocol header information carried by the terminal to be authenticated when making an association network access request, the device attribute information is obtained. The device attribute information includes at least the type and version of the operating system, the device manufacturer information, and the network interface type. During the time window from when the network access request is initiated to when the authentication decision is completed, the connection probe behavior, protocol interaction characteristics and traffic rate fluctuations of the terminal to be authenticated at the network layer are continuously collected as the network behavior characteristics. The discrete category information in the device attribute information is processed by one-hot encoding and converted into a numerical vector. The network behavior features are normalized and standardized and converted into numerical vectors with the same scale. The encoded device attribute information vector is concatenated with the standardized network behavior feature vector to form the dynamic authentication feature vector.

5. The method for improving authentication accuracy in scenarios with dynamically changing MAC addresses according to claim 4, characterized in that, The step of using the associated feature indicators to weight and fuse the dynamic authentication feature vector to generate a comprehensive terminal identity confidence score specifically includes: Design a weight allocation function, using the correlation feature index as the input variable of the weight allocation function; A fusion weight value is calculated using the weight allocation function, and the fusion weight value is positively correlated with the associated feature index. The scalar multiplication operation is performed between the fusion weight value and the dynamic authentication feature vector to obtain the weighted dynamic authentication feature vector; The weighted dynamic authentication feature vector is input into a pre-trained lightweight identity confidence assessment model. The output of the lightweight identity confidence assessment model is a probability value between zero and one. The normalized probability value output by the lightweight identity confidence assessment model is used as the terminal's comprehensive identity confidence.

6. The method for improving authentication accuracy in scenarios with dynamically changing MAC addresses according to claim 5, characterized in that, The pre-training process of the lightweight identity confidence assessment model is as follows: Collect a dataset containing historical network authentication events as training samples. Each training sample contains historical terminal identifiers, historical dynamic authentication feature vectors, and the real labels of the corresponding authentication events' final manual review or system backtracking confirmation. The training samples are cleaned to remove samples with abnormal feature values ​​or incorrect labels, forming a high-quality benchmark training set. Construct a multilayer perceptron model with one input layer, at least one hidden layer, and one output layer as the initial identity confidence evaluation model; The historical dynamic authentication feature vectors in the benchmark training set are used as the input of the initial identity confidence assessment model, and the corresponding real labels are used as the supervision signals. The weight parameters of the initial identity confidence assessment model are iteratively optimized using the backpropagation algorithm and the gradient descent method. The model is evaluated using an independent validation set during the optimization process. The model performance is monitored using the cross-entropy loss function. Training is stopped when the performance on the validation set tends to stabilize, thus obtaining the final lightweight identity confidence evaluation model.

7. The method for improving authentication accuracy in scenarios with dynamically changing MAC addresses according to claim 5, characterized in that, The step of making an authentication decision to grant or deny network access based on the terminal's comprehensive identity confidence level and a preset authentication policy threshold specifically involves: The system administrator pre-sets two authentication decision thresholds: a high-confidence permission threshold and a low-confidence rejection threshold; When making authentication decisions, the overall identity confidence level of the terminal is compared with the high confidence permission threshold and the low confidence rejection threshold; If the overall identity confidence level of the terminal is greater than or equal to the high confidence level permission threshold, the identity of the terminal to be authenticated is determined to be legitimate and trustworthy, and a network access permission instruction is directly generated to authorize the terminal to be authenticated to access the target network. If the overall identity confidence level of the terminal is less than or equal to the low confidence rejection threshold, the identity of the terminal to be authenticated is determined to be suspicious or illegal, a network access rejection instruction is generated, the access request of the terminal to be authenticated is rejected, and the corresponding event may be selectively recorded to the audit log. If the overall identity confidence level of the terminal is between the low confidence rejection threshold and the high confidence permission threshold, it is determined that further verification is required, and an auxiliary authentication process is triggered.

8. The method for improving authentication accuracy in scenarios with dynamically changing MAC addresses according to claim 7, characterized in that, The triggering of the auxiliary authentication process is specifically as follows: Send a notification message containing a time-sensitive temporary token to the terminal to be authenticated or its associated user account, the notification message being sent via a backup communication channel; Start a timer to listen for responses from the terminal to be authenticated within a preset validity period. The responses must contain the correct time-sensitive temporary token. If a response containing the correct token is received within the validity period, the auxiliary authentication is considered successful, the overall identity confidence of the terminal is adjusted upwards, and the authentication decision process is re-executed based on the adjusted confidence. If no response is received within the validity period or the received token is incorrect, the auxiliary authentication is considered to have failed. The overall identity confidence of the terminal is then adjusted downwards, and the authentication decision process is re-executed based on the adjusted confidence, or access is directly denied. Regardless of whether the assisted authentication is successful or not, the complete feature vector, confidence value, and final decision result of this decision will be recorded in the historical mapping database for subsequent model training and database updates.

9. The method for improving authentication accuracy in scenarios with dynamically changing MAC addresses according to claim 1, characterized in that, After the authentication decision is completed, the process also includes an incremental update step of the historical mapping database: Record the process data of this authentication event. The process data includes at least the terminal identifier of the terminal to be authenticated, the current MAC address, the dynamic authentication feature vector, the terminal's comprehensive identity confidence level, and the final authentication decision result. Based on the final authentication decision, this authentication event will be classified as a successful authentication event or a failed authentication event. For a successful authentication event, the current MAC address used in this authentication is used as a new data point and inserted into the historical MAC address sequence corresponding to the terminal identifier according to its timestamp, and the oldest data point in the historical MAC address sequence is removed to keep the sequence length constant. For failed authentication events, the association between the terminal identifier and the current MAC address is analyzed to determine whether it is suspicious. If it is determined to be a malicious forgery or fraudulent association, the current MAC address is added to a shared blacklist of abnormal MAC addresses, and the historical mapping database is notified to globally block the current MAC address.

10. A system for improving authentication accuracy in scenarios with dynamically changing MAC addresses, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the authentication accuracy improvement method for dynamic MAC address change scenarios as described in any one of claims 1 to 9.

Images