Identity authentication anomaly detection method based on automatic perception
By integrating long short-term memory networks and attention mechanisms based on environmental, behavioral, and temporal data, an end-to-end identity authentication system is constructed. This solves the problems of multi-dimensional data fusion and adaptive learning, achieving highly accurate and robust anomaly detection, reducing the risk of misjudgment and deployment costs, and protecting user privacy.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- GUO MI LAN SHIELD (SHANDONG) INFORMATION SECURITY TECH CO LTD
- Filing Date
- 2026-03-18
- Publication Date
- 2026-04-14
AI Technical Summary
Existing identity authentication technologies struggle to effectively integrate multi-dimensional heterogeneous data and cannot adaptively learn user behavior patterns, resulting in insufficient accuracy and robustness in anomaly identification and potential misjudgments due to changes in user behavior.
An automatic perception-based identity authentication method is adopted. By integrating environmental, behavioral, and temporal data through long short-term memory networks and attention mechanisms, an end-to-end identity authentication system is constructed to achieve multi-dimensional perception and adaptive learning, and generate a contextual baseline for anomaly detection.
It significantly improves the accuracy and robustness of anomaly identification, enabling the identification of sudden and slow abnormal behaviors, reducing the risk of misjudgment, and eliminating the need for manual rule setting, thereby reducing deployment and maintenance costs and protecting user privacy.
Smart Images
Figure CN121865264A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security and identity authentication technology, and specifically to an automatic perception-based method for detecting identity authentication anomalies. Background Technology
[0002] Current identity authentication technology is continuously evolving towards intelligence, dynamism, and context awareness. Integrating multi-dimensional information for continuous risk assessment has become an important way to improve security levels. With the popularization of mobile computing and IoT devices, it has become possible to collect dynamic data such as user behavior characteristics, device identification, and environmental context, which lays the data foundation for building more refined authentication models.
[0003] Meanwhile, deep learning technology has demonstrated powerful capabilities in sequence modeling and feature fusion, especially recurrent neural networks and attention mechanisms, which provide effective tools for understanding the temporal patterns and dynamic relationships of user behavior.
[0004] Given this trend, how to organically integrate heterogeneous data from multiple perception dimensions such as environment, behavior, and time, and build an intelligent authentication system that can adaptively learn users' normal behavior patterns and accurately identify abnormal requests, is a direction worthy of in-depth exploration in current research and applications. Summary of the Invention
[0005] The purpose of this invention is to address the problems existing in the background technology by proposing an automatic perception-based method for detecting identity authentication anomalies.
[0006] The technical solution of this invention: a method for detecting anomalies in identity authentication based on automatic perception, comprising the following specific implementation steps: S1. The raw login data collected by the client is vectorized and embedded to obtain a unified high-dimensional dense feature representation; the raw login data includes environmental data, behavioral dynamics data and timestamp information; S2. Concatenate the environmental feature vector, behavioral feature vector, and temporal feature vector corresponding to a single login to form a comprehensive feature vector representing the login; extract the comprehensive feature vectors of the user's most recent N historical logins and construct a historical behavior sequence matrix in chronological order; at the same time, process the current login request to obtain the current feature vector; S3. Input the historical behavior sequence matrix into the long short-term memory network for time series modeling, calculate the hidden state at each time step in turn, and output a sequence containing the hidden states of all time steps. S4. Using the current feature vector as a query, calculate its similarity score with each state in the historical hidden state sequence, and normalize it to obtain the attention weight; perform a weighted summation of the historical hidden states according to the attention weight to generate a context baseline vector; concatenate the context baseline vector with the current feature vector and input it into the classifier to calculate the anomaly probability, and determine whether the current login is abnormal according to a preset threshold.
[0007] Preferably, in step S1, the specific process of vectorizing and embedding the raw login data collected by the client includes: First, the IP address is mapped to a fixed-size sparse index using a hash function, and then transformed into a first dense vector through a trainable embedding layer. Meanwhile, the device's unique identifier is mapped to a fixed-size sparse index using a hash function and then transformed into a second dense vector through a trainable embedding layer. Secondly, the scanned list of surrounding Wi-Fi base station BSSIDs is converted into a fixed-length binary vector using multi-hot encoding, and then processed through an embedding layer to obtain the third dense vector of the environmental fingerprint. Finally, the first dense vector, the second dense vector, and the third dense vector are concatenated to obtain the comprehensive environmental feature vector.
[0008] Preferably, in step S1, the behavioral dynamics data is vectorized and embedded, specifically including: Behavioral dynamics data includes keystroke flight time and key dwell time; First, the behavioral data for each dimension is standardized by subtracting the mean of the feature on the training set from the original behavioral feature value and then dividing by the standard deviation of the feature on the training set. The standardized feature vectors are then input into a multilayer perceptron consisting of several fully connected layers and nonlinear activation functions to extract higher-order nonlinear features. The final output is the latent feature vector of biological behavior.
[0009] Preferably, in step S1, the timestamp information is vectorized, and the specific process includes: Extract the hour and week number from the login timestamp; The hours and weeks are periodically encoded using sine and cosine functions, respectively. The time feature vector composed of the encoding results of sine and cosine functions is used as the time series feature vector.
[0010] Preferably, the keystroke flight time is the time interval between two keystrokes; Key dwell time is the duration for which a single key is pressed continuously. Behavioral dynamics data is captured by the client during the user login interaction process and constitutes the raw behavioral data set.
[0011] Preferably, in step S2, the process of constructing the historical behavior sequence matrix is as follows: For a specific user, retrieve their most recent N successful login records from their database; The comprehensive feature vectors corresponding to each historical login record are arranged in order of login time from earliest to latest to form the user's historical behavior sequence matrix; The comprehensive feature vector corresponding to the earliest historical login record is located at the beginning of the sequence, and the comprehensive feature vector corresponding to the most recent historical login record is located at the end of the sequence.
[0012] Preferably, in step S3, the process of inputting the historical behavior sequence matrix into the long short-term memory network for time-series modeling is as follows: The Long Short-Term Memory network receives two inputs at each time step: one is the comprehensive feature vector of the historical logins corresponding to the current time step, and the other is the hidden state calculated in the previous time step. The gating mechanism inside the Long Short-Term Memory (LSTM) network processes each comprehensive feature vector in the historical behavior sequence matrix sequentially, and finally outputs a sequence containing the hidden state vectors output by the LTM network after processing each time step.
[0013] Preferably, in step S4, the similarity score calculation process includes: Set a learnable weight matrix; The current feature vector and each historical hidden state vector are respectively processed by the learnable weight matrix to obtain the unnormalized similarity score corresponding to the current feature vector and each historical hidden state vector.
[0014] Preferably, in step S4, the classifier is specifically a fully connected layer followed by a Sigmoid activation function; The concatenated context baseline vector and the current feature vector are used as inputs to the fully connected layer. After calculation by the fully connected layer and the Sigmoid activation function, a value between zero and one is output as the anomaly probability.
[0015] Preferably, in step S4, the specific rule for determining whether the current login is abnormal based on a preset threshold is as follows: The calculated anomaly probability is compared with a preset anomaly judgment threshold. If the abnormal probability is greater than or equal to the preset abnormal judgment threshold, then the current login request is determined to be an abnormal login. If the anomaly probability is less than the preset anomaly judgment threshold, then the current login request is determined to be a normal login. For login requests deemed abnormal, the system triggers at least one security response measure, including two-factor authentication, an alarm, or blocking access.
[0016] Compared with the prior art, the above-mentioned technical solution of the present invention has the following beneficial technical effects: This invention designs an automatic perception-based anomaly detection method for identity authentication. First, by fusing environmental physical field data, user behavior dynamics data, and time series information, this method achieves multi-dimensional and fine-grained perception and representation of the login scenario, effectively overcoming the limitation of single features being easily counterfeited or tampered with, and significantly improving the accuracy and robustness of anomaly identification. Second, by using a Long Short-Term Memory (LSTM) network to model the user's historical behavior sequence, it can capture the long-term dependence and slow evolution patterns of their behavioral habits, enabling the system to detect not only sudden anomalies but also slowly shifting abnormal behavior patterns, enhancing the system's continuous adaptability. Third, an attention mechanism is introduced to dynamically associate the current login with... The historical normal mode can adaptively generate a context baseline for the current scenario, avoiding misjudgments caused by normal changes in user behavior, thereby improving security while ensuring the login experience of legitimate users. In addition, the entire solution of this invention adopts an end-to-end automated process, eliminating the need for manual setting of complex rules, reducing deployment and maintenance costs, and all feature extraction and judgment processes are completed under model-driven conditions, possessing strong scalability and engineering practicality. Finally, this invention only relies on the perception data that can be securely collected by the client, without involving sensitive biometric information or plaintext passwords, which improves the level of security protection while also helping to protect user privacy, in line with the relevant requirements for current personal information protection and data security. Attached Figure Description
[0017] Figure 1 This is a schematic diagram of the framework of an automatic perception-based identity authentication anomaly detection method proposed in this invention. Detailed Implementation
[0018] Example 1, as Figure 1 As shown, the present invention proposes an automatic perception-based identity authentication anomaly detection method, the specific implementation steps of which are as follows: S1. The raw heterogeneous login data collected from the client is vectorized and embedded, namely: the IP and device ID in the environmental data are hashed and embedded to obtain dense vectors; the Wi-Fi list is multi-hot encoded and embedded; the behavioral dynamics data is standardized and mapped into nonlinear feature vectors through MLP; the timestamps are sine and cosine periodically encoded, and finally, various heterogeneous data are transformed into a unified high-dimensional dense vector representation, specifically: S11. The IP address and device ID are converted into a dense vector using hash mapping and embedding layer. The Wi-Fi BSSID list is then multi-hot encoded and embedded. Finally, the vectors are concatenated to obtain the comprehensive environmental feature vector, as follows: The client SDK actively collects environmental physical field data when the user logs in, forming a raw environmental data set. ; First, for IP addresses with discrete and sparse characteristics... and device unique identifier A hash function is used to map the sparse index to a fixed-size sparse index. Then, a trainable embedding layer transforms the sparse index into a low-dimensional dense vector, yielding the following results: and ; Secondly, regarding the scanned list of surrounding Wi-Fi base station BSSIDs Multi-hot encoding is used to transform it into a fixed-length binary vector, where each position corresponds to a base station in a preset BSSID set; a value of 1 indicates the presence of the base station, and 0 indicates the absence of a base station. This binary vector is also processed by an embedding layer to obtain a dense vector representation of the environmental fingerprint. ; Finally, the three environmental feature vectors are concatenated to obtain a comprehensive environmental feature vector. : ; in, This refers to the set of raw environmental data actively collected through client-side sensing. This indicates the original IP address used by the user when logging in; A unique hardware or software identifier that represents a user equipment; This represents a list of MAC addresses of surrounding Wi-Fi base stations scanned by the client. This represents a dense vector generated after the IP address has undergone hash mapping and embedding layer processing; This represents a dense vector generated after the device ID is processed by hash mapping and embedding layer; This represents the environmental fingerprint vector generated after the Wi-Fi BSSID list has undergone multi-hot encoding and embedding layer processing; This represents the composite environmental feature vector formed by splicing together features. This represents the vector concatenation operator; S12. The keystroke flight time and key dwell time are standardized, and then the nonlinear biological behavior latent feature vector is extracted through multilayer perceptron mapping, specifically: The client simultaneously captures biodynamic data of user interactions, forming a raw behavioral data set. ; First, the behavioral data x for each dimension is standardized: ; Subsequently, the standardized feature vector is input into a multilayer perceptron (MLP) to extract higher-order nonlinear features. This MLP consists of several fully connected layers and nonlinear activation functions (such as ReLU), ultimately outputting a latent feature vector of biological behavior. ; in, This represents the set of raw user biometric data collected by the client. This indicates the keystroke flight time, which is the time interval between two keystrokes; This indicates the key dwell time, i.e., the duration for which a single key is pressed continuously; x represents the original behavioral characteristic value. Represents the standardized numerical value of behavioral characteristics; This represents the mean of the behavioral feature on the training set; This represents the standard deviation of the behavioral feature on the training set; This represents the nonlinear latent feature vector obtained by mapping standardized behavioral features through a multilayer perceptron. S13. Extract the hour and day of the week information from the login timestamp, and use sine and cosine functions for periodic encoding to generate a feature vector that retains the time period logic, specifically: To preserve periodic patterns in time data (such as daily or weekly cycles), the login timestamp t is periodically encoded. Extract the hour from the timestamp t. (0~23) and weekday (0-6, 0 represents Monday), encoded using sine and cosine functions to generate time feature vectors. : ; This encoding method ensures that points that are temporally adjacent and have similar periods also remain close in the vector space; in, This indicates the relationship between sine and cosine functions. and The time feature vector obtained by periodic encoding.
[0019] S2. The multi-dimensional features of a single login are fused into a comprehensive feature vector, and a user's historical behavior sequence is constructed. This involves concatenating the environment, behavior, and time-series feature vectors to form a comprehensive feature vector representing the entirety of a single login. The comprehensive feature vectors of the user's most recent N historical logins are extracted, arranged in order to construct a historical behavior sequence matrix, and a corresponding feature vector is generated for the current request to be detected. Specifically: S21. The environmental feature vector, behavioral feature vector, and temporal feature vector at the same login time are concatenated to generate a comprehensive feature vector for that login, specifically: For any login occurring at time t, the three feature vectors obtained in step S1 are concatenated to obtain a comprehensive feature vector representing the overall picture of that login. : ; in, This represents the comprehensive feature vector of a single login at time t; S22. Extract the comprehensive feature vectors corresponding to the user's most recent N successful login records in chronological order to form a historical behavior sequence matrix; simultaneously process the current login request to obtain the current feature vector, specifically: For a specific user, extract their most recent N successful login records from the database, and arrange the comprehensive feature vectors corresponding to each record in chronological order to form the user's historical behavior sequence matrix. : ; Simultaneously, the current login request to be detected is processed according to steps S1 and 21 to obtain its feature vector. ; in, This indicates the number of times a user has logged in recently (N times). A sequence matrix arranged in chronological order; Indicates the earliest record; Indicates the most recent record; This represents the comprehensive feature vector corresponding to the login request to be detected.
[0020] S3. Utilize Long Short-Term Memory (LSTM) networks to perform temporal modeling of user historical behavior sequences, capturing the long-range dependencies and evolution patterns of behavior. Specifically, the historical sequence matrix is input into an LSTM network, processed sequentially through its gating mechanism, and outputs a sequence containing all hidden states at each time step. Each hidden state encodes a mixture of user spatiotemporal and behavioral information up to that moment. The historical behavior sequence matrix is input into the LSTM network, and the hidden state at each time step is calculated sequentially. The final output is a sequence of hidden states containing long-term memory information, i.e.: Historical sequence As input, the data is fed into a Long Short-Term Memory (LSTM) network, which receives the current input at each time step t. The hidden state of the previous time step : ; After processing N time steps in sequence, the output sequence containing the hidden states of all time steps is obtained. : ; in, This represents the hidden state of the LSTM in the previous time step; This represents the hidden state vector output by the LSTM at the current time step, which contains temporal memory; This indicates that LSTM processes the entire The set of all hidden state sequences at all time steps output later.
[0021] S4. Dynamically associate the current login with historical patterns through an attention mechanism and complete the anomaly judgment, that is: using the current feature as the query, calculate its similarity weight with the historical hidden state; generate a contextualized context baseline vector by weighted summation of the historical states according to the weight; concatenate the baseline vector with the current feature and input it into the classifier, calculate the anomaly probability and compare it with the threshold to make the final judgment, specifically: S41. Use the current feature vector to query the historical hidden state sequence, calculate the similarity score through the learnable weight matrix, and obtain the attention weight coefficients through Softmax normalization, specifically: With the current login feature vector As a query, the historical hidden state sequence output by the LSTM is used. As keys and values; through a learnable weight matrix Calculate the query and each historical state Similarity score : ; Subsequently, the attention weights are obtained by normalizing all scores using the Softmax function. It indicates the importance of the i-th historical login to the current login decision: ; in, This represents the learnable weight matrix in the attention mechanism, used to calculate the relevance between the query and the historical state; Indicates current login characteristics With the i-th hidden state in history The unnormalized similarity score; This represents the attention weight obtained after Softmax normalization, which is the importance of the i-th historical login to the current decision; S42. Based on the attention weight coefficients, the historical hidden state sequence is weighted and summed to generate a dynamic context baseline vector for the current scene, specifically: Based on the calculated attention weights, the historical hidden states are weighted and summed to generate a context baseline vector C that focuses on the history most relevant to the current scene: ; Where C represents the context baseline vector, which is obtained by weighting the historical hidden states according to the attention weights, and represents the dynamically generated normal behavior baseline; S43. Concatenate the context baseline vector with the current feature vector, input it into a classification layer with a Sigmoid activation function to calculate the anomaly probability, and determine whether the login is abnormal based on a preset threshold. Specifically: Compare the context baseline vector C with the current login feature vector The features are concatenated to form the final fused feature vector used for classification. : ; Will Input a fully connected classification layer (which can be viewed as a single-layer perceptron) and output the anomaly probability through a sigmoid activation function. : ; like If the current login request is not found to be normal, it is considered abnormal; otherwise, it is considered normal. For abnormal requests, the system may trigger security measures such as secondary verification, alarms, or direct blocking. in, This represents the final fused feature vector; This represents the weight matrix of the output classification layer; This represents the bias term of the output classification layer; This represents the probability value that the model predicts the current login to be abnormal; This represents the preset anomaly detection threshold, which is used for the final determination.
[0022] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited thereto. Various changes can be made within the scope of knowledge possessed by those skilled in the art without departing from the spirit of the present invention.
Claims
1. A method for detecting anomalies in identity authentication based on automatic perception, characterized in that, The specific implementation steps include the following: S1. The raw login data collected by the client is vectorized and embedded to obtain a unified high-dimensional dense feature representation; the raw login data includes environmental data, behavioral dynamics data and timestamp information; S2. Concatenate the environmental feature vector, behavioral feature vector, and temporal feature vector corresponding to a single login to form a comprehensive feature vector representing the login; extract the comprehensive feature vectors of the user's most recent N historical logins and construct a historical behavior sequence matrix in chronological order; at the same time, process the current login request to obtain the current feature vector; S3. Input the historical behavior sequence matrix into the long short-term memory network for time series modeling, calculate the hidden state at each time step in turn, and output a sequence containing the hidden states of all time steps. S4. Using the current feature vector as a query, calculate its similarity score with each state in the historical hidden state sequence, and normalize it to obtain the attention weight; perform a weighted summation of the historical hidden states according to the attention weight to generate a context baseline vector; concatenate the context baseline vector with the current feature vector and input it into the classifier to calculate the anomaly probability, and determine whether the current login is abnormal according to a preset threshold.
2. The method for detecting anomalies in identity authentication based on automatic perception according to claim 1, characterized in that, In step S1, the specific process of vectorizing and embedding the raw login data collected by the client includes: First, the IP address is mapped to a fixed-size sparse index using a hash function, and then transformed into a first dense vector through a trainable embedding layer. Meanwhile, the device's unique identifier is mapped to a fixed-size sparse index using a hash function and then transformed into a second dense vector through a trainable embedding layer. Secondly, the scanned list of surrounding Wi-Fi base station BSSIDs is converted into a fixed-length binary vector using multi-hot encoding, and then processed through an embedding layer to obtain the third dense vector of the environmental fingerprint. Finally, the first dense vector, the second dense vector, and the third dense vector are concatenated to obtain the comprehensive environmental feature vector.
3. The method for detecting anomalies in identity authentication based on automatic perception according to claim 2, characterized in that, In step S1, the behavioral dynamics data is vectorized and embedded. The specific process includes: Behavioral dynamics data includes keystroke flight time and key dwell time; First, the behavioral data for each dimension is standardized by subtracting the mean of the feature on the training set from the original behavioral feature value and then dividing by the standard deviation of the feature on the training set. The standardized feature vectors are then input into a multilayer perceptron consisting of several fully connected layers and nonlinear activation functions to extract higher-order nonlinear features. The final output is the latent feature vector of biological behavior.
4. The method for detecting identity authentication anomalies based on automatic perception according to claim 3, characterized in that, In step S1, the timestamp information is vectorized, and the specific process includes: Extract the hour and week number from the login timestamp; The hours and weeks are periodically encoded using sine and cosine functions, respectively. The time feature vector composed of the encoding results of sine and cosine functions is used as the time series feature vector.
5. The method for detecting anomalies in identity authentication based on automatic perception according to claim 3, characterized in that, Keystroke flight time is the time interval between two keystrokes; Key dwell time is the duration for which a single key is pressed continuously. Behavioral dynamics data is captured by the client during the user login interaction process and constitutes the raw behavioral data set.
6. The method for detecting anomalies in identity authentication based on automatic perception according to claim 5, characterized in that, In step S2, the construction process of the historical behavior sequence matrix is as follows: For a specific user, retrieve their most recent N successful login records from their database; The comprehensive feature vectors corresponding to each historical login record are arranged in order of login time from earliest to latest to form the user's historical behavior sequence matrix; The comprehensive feature vector corresponding to the earliest historical login record is located at the beginning of the sequence, and the comprehensive feature vector corresponding to the most recent historical login record is located at the end of the sequence.
7. The method for detecting anomalies in identity authentication based on automatic perception according to claim 6, characterized in that, In step S3, the process of inputting the historical behavior sequence matrix into the long short-term memory network for time-series modeling is as follows: The Long Short-Term Memory network receives two inputs at each time step: one is the comprehensive feature vector of the historical logins corresponding to the current time step, and the other is the hidden state calculated in the previous time step. The gating mechanism inside the Long Short-Term Memory (LSTM) network processes each comprehensive feature vector in the historical behavior sequence matrix sequentially, and finally outputs a sequence containing the hidden state vectors output by the LTM network after processing each time step.
8. The method for detecting anomalies in identity authentication based on automatic perception according to claim 7, characterized in that, In step S4, the similarity score calculation process includes: Set a learnable weight matrix; The current feature vector and each historical hidden state vector are respectively processed by the learnable weight matrix to obtain the unnormalized similarity score corresponding to the current feature vector and each historical hidden state vector.
9. The method for detecting anomalies in identity authentication based on automatic perception according to claim 8, characterized in that, In step S4, the classifier is specifically a fully connected layer followed by a Sigmoid activation function; The concatenated context baseline vector and the current feature vector are used as inputs to the fully connected layer. After calculation by the fully connected layer and the Sigmoid activation function, a value between zero and one is output as the anomaly probability.
10. The method for detecting anomalies in identity authentication based on automatic perception according to claim 9, characterized in that, In step S4, the specific rules for determining whether the current login is abnormal based on a preset threshold are as follows: The calculated anomaly probability is compared with a preset anomaly judgment threshold. If the abnormal probability is greater than or equal to the preset abnormal judgment threshold, then the current login request is determined to be an abnormal login. If the anomaly probability is less than the preset anomaly judgment threshold, then the current login request is determined to be a normal login. For login requests deemed abnormal, the system triggers at least one security response measure, including two-factor authentication, an alarm, or blocking access.