Intelligent identity authentication and authority control method under global security intelligent protection
By combining multi-level verification and user behavior profiling with anomaly detection algorithms and event flow graph neural networks for real-time threat analysis, the shortcomings of traditional identity authentication and security event analysis are addressed, enabling accurate identification and rapid response to malicious attacks.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- BEIJING HONGSHAN INFORMATION TECH RES CO LTD
- Filing Date
- 2026-02-02
- Publication Date
- 2026-04-28
AI Technical Summary
Traditional authentication methods are ineffective against phishing and credential theft attacks. Abnormal login detection relies on simple rules, resulting in a high false alarm rate. Security incident analysis and response are delayed, making it difficult to uncover collaborative attack chains across entities and time.
A multi-level verification mechanism is introduced, combining user behavior profiling and dynamic context anomaly detection algorithms. An event flow graph neural network is used for real-time threat analysis, and a memory-enhanced temporal variational autoencoder is used for continuous learning and modeling to achieve accurate assessment and response to user behavior.
It achieves accurate differentiation of malicious attacks, reduces the false alarm rate of anomaly detection, shortens threat discovery time, improves the ability to identify low-frequency, slow attacks, and enhances user experience and security.
Smart Images
Figure CN121940205A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data security technology, and more specifically, to a method for intelligent identity authentication and access control under comprehensive security protection. Background Technology
[0002] With the deepening of digital transformation and the advancement of the national cybersecurity strategy, the complexity and openness of information systems in government, finance, energy and large enterprises are increasing day by day. The number of service objects, access devices, participating vendors and business scenarios are growing explosively, which poses a severe challenge to the traditional security management system based on perimeter defense and static rules, especially in the field of identity authentication and access control.
[0003] At the identity authentication level, traditional static authentication methods are no longer sufficient to defend against phishing and credential theft attacks. Although the introduction of multi-factor authentication (MFA) has improved security, its deployment is often independent of the business context, and the session behavior after successful authentication lacks continuous monitoring, making it unable to effectively address risks such as account hijacking and internal abuse. Existing abnormal login detection methods mostly rely on simple frequency rules or fixed IP / time rules, lacking refined modeling of individual user behavior habits. This makes it difficult to distinguish between genuine malicious attacks and reasonable behavioral changes caused by business trips, device changes, etc., resulting in high false positive rates, poor user experience, or failure to detect hidden low-frequency, slow attacks.
[0004] At the security operations and threat awareness level, massive amounts of logs, events and alarm data are scattered across different devices and systems. The analysis methods are based on fixed rule-based correlation analysis and post-event backtracking. However, this model is slow to respond and makes it difficult to automatically mine collaborative attack chains across multiple entities and time from massive amounts of discrete, high-dimensional and time-related events.
[0005] In summary, existing solutions have shortcomings in key areas such as risk control for identity authentication, security incident analysis, real-time insights, and user behavior modeling. There is an urgent need for an integrated intelligent security management approach that deeply integrates identity, behavior, and context to address increasingly complex cyber threats and ensure the security of core business operations and data. Summary of the Invention
[0006] In view of this, the present invention proposes an intelligent identity authentication and access control method under the comprehensive security protection, in order to solve the problems existing in the prior art.
[0007] To achieve the above objectives, this invention proposes an intelligent identity authentication and access control method under comprehensive security protection, including: In the identity authentication process, a multi-level verification mechanism including two-factor authentication is introduced, and based on user behavior profiles and dynamic context, an optimized anomaly detection algorithm is used to conduct real-time risk assessment and graded response for login behavior. Implement session security management policies and strong password policies, and establish a centralized audit and monitoring platform. Utilize a temporal pattern mining engine based on event flow graph neural networks to analyze security events, detect potential threats in real time, and issue alerts. Continuous unsupervised online learning and modeling of user access behavior is performed. A temporal variational autoencoder framework based on memory enhancement is adopted. By comparing the similarity between real-time behavior sequences and normal behavior memory, sensitive operations that deviate from normal patterns are identified and a graded intervention process is automatically triggered.
[0008] Furthermore, the method of using an optimized anomaly detection algorithm to perform real-time risk assessment and tiered response for login behavior based on user behavior profiles and dynamic context specifically includes: A multi-dimensional behavioral baseline profile is constructed and continuously updated for each user, including login region, time window, device fingerprint, and network access point characteristics. When a new login event occurs, extract the context features of this login and transform them into a high-dimensional sparse feature vector; An improved local outlier factor algorithm is adopted, based on a cosine distance and density-sensitive adaptive neighborhood selection mechanism, to calculate the outlier factor of this login relative to the user's own historical behavior clustering and the global user behavior background, respectively. The weights are dynamically adjusted based on the contour coefficient of the user's historical behavior, and the two outlier factors are fused to obtain the final anomaly score. The final anomaly score is then compared with the global background to distinguish between malicious attacks and changes in user habits. Based on the different risk ranges in which the final anomaly score is located, corresponding graded response measures are triggered.
[0009] Furthermore, in the improved local outlier factor algorithm, the neighborhood of point p... By adaptive neighborhood radius Sure, It is defined as the ρth quantile of the cosine distance distribution from point p to all other points in the dataset.
[0010] Furthermore, the final anomaly score The calculation formula is derived through a weighted harmonic summation of two-layer outlier factors:
[0011] in, The LOF value on the normal login point set. The global outlier factor on the recent login point set, with weights The contour coefficients are dynamically calculated based on the user's own historical behavior points.
[0012] Furthermore, the analysis of security events using a temporal pattern mining engine based on an event flow graph neural network specifically includes: The standardized security event streams captured in real time are constructed into a dynamically evolving temporal knowledge graph according to fixed time windows; The temporal knowledge graph is input into the event flow graph neural network model. The feature information of nodes on temporal neighbors is aggregated through the temporal graph convolutional layer, and the importance weight of different event edges for threat judgment is calculated using the edge attention mechanism. The model outputs a global threat score and threat embedding vectors for each node in the graph. If the score exceeds a threshold, an alarm is triggered, and the key subgraphs that lead to high threat scores are extracted in reverse based on attention weights as the basis for root cause analysis. The detected threat patterns are converted into short-term monitoring rules and injected into the fast matching filter layer. Incremental learning is performed on confirmed attack events to optimize the model.
[0013] Furthermore, the update formula for the temporal knowledge graph, which integrates historical states, is as follows:
[0014] in, For the new event graphing function, For historical graph memory functions, This is the memory decay coefficient, which controls the degree to which historical information is retained.
[0015] Furthermore, the continuous learning and modeling of user access behavior using a memory-enhanced temporal variational autoencoder framework specifically includes: The user's access event sequence is transformed into a behavior sequence fragment, which is then encoded into a distribution in the latent space by a temporal variational autoencoder and sampled to obtain a latent vector. The similarity between the latent vector and the historical normal pattern prototype vector stored in the memory matrix is calculated to obtain the memory matching degree. At the same time, the reconstruction error between the original sequence and the reconstructed sequence is calculated. Calculate the composite anomaly score based on the reconstruction error and the memory matching degree; The composite anomaly score is judged based on a dynamic threshold, and graded intervention is triggered according to the extent of exceeding the limit and the level of operational sensitivity. Using new behavioral sequences that have been confirmed to be normal after a cooling-off observation period, the encoder, decoder parameters, and memory matrix are updated via online learning.
[0016] Furthermore, the memory matrix is updated using a competitive update mechanism: If the new vector is highly similar to an existing row in the memory matrix, then update the vector in that row to make it closer to the new vector; otherwise, if the new vector is significantly different from all existing rows, then replace the least frequently used row in the memory matrix with it.
[0017] Furthermore, the high-strength password strategy includes: the password length is no less than eight characters, it must contain a combination of uppercase and lowercase letters, numbers and special characters, it is mandatory to change the password regularly and the new password must not be the same as the last five historical passwords, and all passwords are transmitted through an encrypted channel based on the national cryptographic algorithm.
[0018] Furthermore, the centralized auditing and monitoring platform collects logs including user login logs, permission operation records, and system security events, and sets control rules for the login failure scenarios: the same account will be automatically locked if it fails to log in consecutively for a set number of times, and provides recovery methods such as manual unlocking by the administrator and automatic unlocking after the conditions are met.
[0019] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention employs an abnormal login assessment model based on user behavior baseline profiles and dynamic context fusion. Through an improved local outlier factor algorithm, it simultaneously calculates individual historical deviation and global background deviation, and introduces a fusion weight dynamically adjusted by the profile coefficient. This achieves accurate differentiation between malicious attacks and reasonable changes in user habits, significantly reducing the false alarm rate of anomaly detection, and enabling early identification of low-frequency, slow attacks.
[0020] This invention employs a temporal pattern mining engine based on event flow graph neural networks to transform discrete security events into dynamically evolving temporal knowledge graphs in real time. It utilizes temporal graph convolution and edge attention mechanisms for deep relational reasoning, breaking through the limitations of traditional rule-based association analysis. It can discover complex collaborative attack chains across entities and time in real time, reducing the average threat discovery time from hours to minutes, and providing interpretable root factor graphs.
[0021] This invention designs an online learning framework for a memory-enhanced temporal variational autoencoder, which effectively solves the high false alarm problem of traditional models through a composite anomaly scoring mechanism, and achieves adaptive following and updating of user behavior baseline. Attached Figure Description
[0022] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. In the drawings: Figure 1 This is a schematic diagram of the intelligent identity authentication and access control method under the comprehensive security protection of this invention. Detailed Implementation
[0023] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the disclosure to those skilled in the art. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.
[0024] This embodiment proposes an intelligent identity authentication and access control method under comprehensive security protection, such as... Figure 1 As shown, it includes: Step 1: The system first divides different management domains based on user roles and responsibilities, ensuring that each user can only access the resources and data required for their corresponding responsibilities, forming the basis of minimum access privileges. Based on this, three independent account types are set up: system administrator, security administrator, and audit administrator. This achieves separation and checks and balances in the approval, granting, and supervision of permissions, preventing abuse of privileges from the management structure.
[0025] In the identity authentication process, a multi-level verification mechanism is introduced. In addition to the regular account password, two-factor authentication is mandatory, and at least one of SMS verification code, dynamic token or biometric recognition is supported to ensure the authenticity and security of login behavior.
[0026] Step 2: The system monitors login behavior in real time, automatically identifying abnormal login attempts such as multiple incorrect password attempts for the same account within a short period or logins from different locations, and triggering protective measures such as temporarily locking the account or strengthening verification requirements, specifically including: A risk assessment model based on user behavior profiles and dynamic context is constructed for accurate identification and response to abnormal logins. The core step of this process is deploying a lightweight edge behavior analysis engine. This engine does not rely on preset static rule thresholds but continuously builds and updates a multi-dimensional behavioral baseline profile for each user account. This profile is dynamically generated by collecting and learning from the user's historical successful login records, covering key dimensions including the latitude and longitude grid of frequently logged-in regions, habitual login time windows, fingerprint hash values of the devices used, and characteristics of habitual network access points. The acquired features are transformed into high-dimensional vectors and smoothly iteratively updated with each successful login.
[0027] When a new login event occurs, the analytics engine compares the real-time contextual features of this login request with the corresponding user's baseline behavioral profile. An improved local outlier factor algorithm is used for calculation, which is specifically optimized for processing sparse, high-dimensional behavioral data. The algorithm not only calculates the deviation between the current login features and the user's historical clusters but also cross-references them within the context of global user behavior to distinguish between genuine malicious attacks and reasonable changes in user habits. Specifically, this includes: Feature vectorization and distance definition: Each login event is abstracted as a high-dimensional sparse feature vector v, containing continuous and categorical attributes. The similarity between vectors is measured using cosine similarity and converted to cosine distance.
[0028] This distance is between [0,2], which is efficient for sparse vector calculation and can effectively capture directional differences.
[0029] Density-Sensitive Adaptive Neighborhood Selection: For a point p to be evaluated, the algorithm adaptively determines its neighborhood based on local density. First, it calculates the cosine distance from p to all other points and fits an exponential decay model to describe the distance distribution. The neighborhood radius is then... Defined as the ρth quantile of the distance value distribution:
[0030] This allows points located in low-density regions to automatically obtain a larger search radius to find enough neighbors. The neighborhood of point p. Includes all that satisfy Point q:
[0031] Improved local reachability density calculation: For any point q, its core distance It is defined as the average cosine distance from q to all points in its own neighborhood N(q).
[0032]
[0033] Then the reachable distance of point p relative to point q is:
[0034] Locally accessible density at point p The reciprocal of the average reachable distance within its neighborhood:
[0035] Two-level outlier calculation: In the historical normal login point set of user u The traditional LOF value is calculated above, i.e.
[0036] in and All are from historical normal login points. The calculation is performed based on the density-sensitive adaptive neighborhood selection and improved local reachability calculation steps described above.
[0037] Global outlier: the set of recent login points for all users The same calculation applies above. .
[0038] Cross-referenced fusion decision: The final outlier score is derived by a two-level factor weighted harmonic sum. .
[0039] Weight β Dynamically adjust based on the profile coefficient of the user's historical behavior:
[0040]
[0041] A silhouette coefficient close to 1 indicates tightly clustered user behavior, suggesting a greater reliance on individual historical patterns; a coefficient close to -1 indicates dispersed historical behavior, requiring more consideration of global patterns. Furthermore, by comparing... and The relative size of the anomaly can be used to infer its nature: like Significantly higher than If the value is significantly higher than expected, it indicates that the login deviates from the user's personal habits but is still common in the global context, and it is judged to be a possible change in habits; if both are significantly higher, it is judged to be a malicious attack.
[0042] A final anomaly score from 0 to 100 is calculated. If the score exceeds the system's adaptive threshold, it is considered an abnormal login attempt. The system then triggers a tiered response mechanism. For anomalies with risk scores in the medium to high range, the system does not immediately block them completely but instead forces a timestamp-based cryptographic challenge response. When the risk score reaches a severe threat level, or when medium to high-risk behaviors occur consecutively within a short period, the system temporarily locks the account and marks the event and all its contextual features as a conclusive attack sample, feeding this information back into the model to strengthen global threat intelligence.
[0043] Understandably, by establishing a unique behavioral baseline for each user, the system can detect more subtle and earlier signs of anomalies. Real-time scoring and response under the edge computing architecture ensures that the latency in handling high-risk logins is reduced to milliseconds, realizing a shift from passive defense to proactive risk interception based on identity intelligence.
[0044] Step 3: In session security management, if a user remains inactive for more than ten minutes after logging in, the system will automatically terminate the session and force logout, effectively preventing session hijacking risks. A strong password policy is also enforced, requiring passwords to be at least eight characters long and containing uppercase and lowercase letters, numbers, and special characters. The system periodically forces users to change their passwords and prohibits the use of the last five passwords. All passwords are transmitted through an encrypted channel.
[0045] Clear control rules are set for login failure scenarios. If the same account fails to log in five times in a row, it will be automatically locked for no less than ten minutes. Two recovery methods are provided: manual unlocking by the administrator and automatic unlocking after certain conditions are met, so as to balance security and user experience.
[0046] Establish a centralized auditing and monitoring platform to continuously collect and analyze user login logs, permission operation records, and system security events. Discover potential threats and issue timely alerts through real-time analysis models. This process deploys a temporal pattern mining engine based on event flow graph neural networks. This engine transforms discrete security events into dynamically evolving knowledge graphs and runs deep learning inference on these graphs in real time to discover advanced persistent threats and collaborative attacks hidden in complex interactions and time series.
[0047] The specific steps are as follows: The platform ingests raw logs from all terminals, servers, applications, and security components across the entire domain in real time. First, it parses and standardizes each log entry, extracting core entities and contextual attributes. Then, the system dynamically appends derived metadata to each event, including but not limited to: the event sequence feature vector within the user's current session, a short-term behavioral statistical summary of the source IP, and a historical access baseline snapshot of the target resource. This metadata, as a high-dimensional feature supplement to the event, provides rich node and edge attributes for subsequent graph construction.
[0048] The system uses fixed time windows to transform the incoming event stream into a dynamic attribute graph with temporal stamps in real time. = ( , , Among them, nodes Represents entities, edges This represents events occurring between entities within the current window, and the attributes attached to nodes and edges. It contains detailed metadata and statistical characteristics of events. Over time, the graph state of the old window is incorporated into the initialization of the graph of the new window in a decaying memory manner, forming an evolutionary graph sequence with temporal continuity.
[0049] The platform is based on a pre-trained event flow graph neural network model. This model receives the current dynamic graph at each time window t. And the map hiding state of the previous few windows as input:
[0050] in, For the new event graphing function, For historical graph memory functions, This is the memory decay coefficient, which controls the degree to which historical information is retained.
[0051] The model operates through temporal graph convolutional layers and an edge attention mechanism. The temporal graph convolutional layers are responsible for aggregating the feature information of each entity node from its temporal neighbors. The node updates are shown below:
[0052] For the graph update function, the new event stream will be... Compared with the previous moment's graph Fusion in, Represents a node In the Hidden representation of layers, Represents a node The set of neighboring nodes, The time jump number represents the number of historical time steps considered. For the edge Time lag Attention weights on the surface.
[0053] The importance weights of different events to the current threat assessment are calculated using a side attention mechanism:
[0054] in, The weight matrix is a learnable matrix. For the edge Feature representation, The time difference feature represents the time interval between events. For activation function, This represents a vector concatenation operation. For a leaky linear rectified activation function, This is a vector of learnable parameters for the attention mechanism.
[0055] After propagation and transformation through a multi-layer graph neural network, the model outputs a real-time threat embedding vector for each entity node in the graph. This vector encodes the anomaly level and threat type tendency of the entity in the current context. Simultaneously, the model analyzes the entire graph... Output global threat score :
[0056] in, For graph pooling functions, For fully connected networks, the graph-level representation is mapped to a threat score. .
[0057] like If the threat score of any critical node exceeds the adaptive threshold, the system immediately triggers an alarm. Based on the attention weights in the neural network, the model reverse-engineers and extracts the key subgraphs leading to the high threat score—that is, a small subset of interconnected entities and events—to form the simplest explanation for suspicious activity, automatically completing root cause analysis.
[0058] in This is a dynamic threshold.
[0059] The platform automatically generates structured alert events based on threat scores and extracted key subgraphs. The alert includes the threat level, the main entities involved, inferred attack paths, and visualized key subgraph data as evidence, and is pushed to the security operations center in real time.
[0060] Meanwhile, the threat patterns detected this time are automatically converted into short-term, high-weight monitoring rules in the form of key subgraphs and corresponding threat embedding vectors, and injected into a lightweight, fast matching filter layer for millisecond-level response to attacks with the same pattern in the next few minutes:
[0061] in, Generate a function for embedding threats.
[0062] In addition, confirmed real attack events and their graph context are tagged and added to the model's incremental learning queue for periodic fine-tuning of the model, enabling intelligent evolution of defense capabilities.
[0063] In addition, all permission allocation and adjustment are carried out through a streamlined platform, which supports a dynamic permission model based on roles and attributes, ensuring that permission changes are reviewed and recorded.
[0064] Step 4: The system backend continuously learns and models user access behavior, using intelligent algorithms to identify sensitive operations that deviate from normal patterns and automatically trigger review or intervention processes. It employs an online learning framework based on a memory-enhanced temporal variational autoencoder. A normal behavior memory bank is dynamically maintained for each privileged user or role. By comparing the similarity between real-time behavior sequences and this memory bank, explicit anomaly detection and non-disruptive online model evolution are achieved.
[0065] The specific steps are as follows: Fine-grained behavior sequence modeling and vectorization: The system extracts all access events for a specified user from audit logs, transforming each event into a structured feature vector containing the operation object, operation type, operation time, resource sensitivity level, and contextual relevance obtained from the graph engine. These discrete events are arranged chronologically and segmented using a sliding time window to form behavior sequence fragments X = [ , , ..., ].
[0066] Forward inference of a memory-enhanced temporal variational autoencoder: Each action sequence segment X is input into a temporal variational autoencoder. This encoder consists of bidirectional LSTM layers, encoding the sequence X into a probability distribution in the latent space. Specifically, the outputs are the mean vector μ and variance vector σ of this distribution.
[0067]
[0068] The system then samples the latent vector z from this distribution. The key here is the memory module, which is a dynamically updated matrix. Each line stores a latent encoding of a normal pattern learned from historical sequences of normal behavior:
[0069] Memory-based anomaly scoring calculation: After obtaining the latent vector z of the current sequence, the system first calculates the cosine similarity between z and all normal pattern row vectors in the memory matrix M, and then selects the K highest similarity values for a weighted average to obtain the memory matching degree. :
[0070]
[0071] Simultaneously, the vector z is fed into the decoder to attempt to reconstruct the original input sequence and generate the reconstructed sequence. :
[0072] Calculate the original sequence X and the reconstructed sequence Reconstruction error between :
[0073] Final composite anomaly score Calculated by the following formula:
[0074] Where λ is an adjustable parameter used to balance the importance of pattern matching and reconstruction capabilities; Γ is a normalization factor determined by the average reconstruction error of the user's historical normal sequences. The higher the value, the more the current behavioral sequence deviates from the memorized normal pattern, and the more difficult the model is to understand.
[0075] Dynamic thresholds and tiered intervention triggers: The system employs dynamic thresholds based on the distribution of users' recent ratings. The result is obtained by adding a certain multiple of the mean absolute deviation to the median score within the rolling time window.
[0076] in, Size of the scrolling time window The sensitivity coefficient, This represents the mean absolute deviation.
[0077] when When the threshold is exceeded, an alarm is triggered, and the intervention strategy is graded according to the magnitude of the threshold exceedance and the sensitivity level of the operation itself: Low-level intervention: For non-sensitive operations that slightly exceed the threshold, the system automatically records and marks them for use in periodic audit reports, and increases the sampling and detection frequency of the user's subsequent behavior.
[0078] Intermediate intervention: For operations that clearly exceed the threshold or involve sensitive resources, the system will trigger a hidden challenge in real time: When the user logs in again, a multi-factor authentication step will be introduced, and the security administrator will be notified at the same time.
[0079] Advanced Intervention: For extremely high-scoring or highly abnormal sequences involving core assets, the system will immediately suspend the user's current session's operation permissions, automatically generate an event report containing behavioral sequence analysis and comparison charts, and forcibly initiate a review process jointly participated in by the security administrator and the user's direct supervisor.
[0080] Continuous unsupervised online learning and memory updates: After a cooling-off period, all behavioral sequences that were not triggered by advanced interventions are assumed to be acceptable new normal behaviors. The system uses these new sequences to fine-tune the encoder and decoder network parameters of the temporal variational autoencoder using online gradient descent.
[0081] in, The weighting coefficients for the KL divergence term.
[0082] Furthermore, the latent vector z of the new sequence is incorporated into the memory matrix M using a competitive update mechanism.
[0083]
[0084]
[0085]
[0086] The merging threshold, Represents similar rows in the memory matrix. This represents the memory row that is used least frequently in the memory matrix.
[0087] The above formula can be understood as follows: if z has a very high similarity to an existing row in M, then update the row vector to make it closer to z; otherwise, if z is significantly different from all existing rows, then replace the row in M that is used the least frequently.
[0088] In this way, the memory bank M can be adaptively updated as user responsibilities and behavioral habits evolve naturally, while maintaining the memory of inherent normal patterns, thus avoiding model forgetting and a surge in false alarms due to concept drift.
[0089] Through the above steps, the backend learning system can understand user behavior habits and keenly detect out-of-bounds movements. It adopts internal threat detection based on personal dynamic behavior baseline modeling and continuous evolution to achieve in-depth defense.
[0090] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.
Claims
1. A method for intelligent identity authentication and access control under comprehensive security protection, characterized in that: include: In the identity authentication process, a multi-level verification mechanism including two-factor authentication is introduced, and based on user behavior profiles and dynamic context, an optimized anomaly detection algorithm is used to conduct real-time risk assessment and graded response for login behavior. Implement session security management policies and strong password policies, and establish a centralized audit and monitoring platform. Utilize a temporal pattern mining engine based on event flow graph neural networks to analyze security events, detect potential threats in real time, and issue alerts. Continuous unsupervised online learning and modeling of user access behavior is performed. A temporal variational autoencoder framework based on memory enhancement is adopted. By comparing the similarity between real-time behavior sequences and normal behavior memory, sensitive operations that deviate from normal patterns are identified and a graded intervention process is automatically triggered.
2. The method according to claim 1, characterized in that, The method of performing real-time risk assessment and tiered response for login behavior based on user behavior profiles and dynamic context, using an optimized anomaly detection algorithm, specifically includes: A multi-dimensional behavioral baseline profile is constructed and continuously updated for each user, including login region, time window, device fingerprint, and network access point characteristics. When a new login event occurs, extract the context features of this login and transform them into a high-dimensional sparse feature vector; An improved local outlier factor algorithm is adopted, based on a cosine distance and density-sensitive adaptive neighborhood selection mechanism, to calculate the outlier factor of this login relative to the user's own historical behavior clustering and the global user behavior background, respectively. The weights are dynamically adjusted based on the contour coefficient of the user's historical behavior, and the two outlier factors are fused to obtain the final anomaly score. The final anomaly score is then compared with the global background to distinguish between malicious attacks and changes in user habits. Based on the different risk ranges in which the final anomaly score is located, corresponding graded response measures are triggered.
3. The method according to claim 2, characterized in that, In the improved local outlier factor algorithm, the neighborhood of point p By adaptive neighborhood radius Sure, It is defined as the ρth quantile of the cosine distance distribution from point p to all other points in the dataset.
4. The method according to claim 2, characterized in that, The final anomaly score The calculation formula is derived through a weighted harmonic summation of two-layer outlier factors: ， in, The LOF value on the normal login point set. The global outlier factor on the recent login point set, with weights The contour coefficients are dynamically calculated based on the user's own historical behavior points.
5. The method according to claim 1, characterized in that, The analysis of security events using a temporal pattern mining engine based on event flow graph neural networks specifically includes: The standardized security event streams captured in real time are constructed into a dynamically evolving temporal knowledge graph according to fixed time windows; The temporal knowledge graph is input into the event flow graph neural network model. The feature information of nodes on temporal neighbors is aggregated through the temporal graph convolutional layer, and the importance weight of different event edges for threat judgment is calculated using the edge attention mechanism. The model outputs a global threat score and threat embedding vectors for each node in the graph. If the score exceeds a threshold, an alarm is triggered, and the key subgraphs that lead to high threat scores are extracted in reverse based on attention weights as the basis for root cause analysis. The detected threat patterns are converted into short-term monitoring rules and injected into the fast matching filter layer. Incremental learning is performed on confirmed attack events to optimize the model.
6. The method according to claim 5, characterized in that, The update formula for the time-series knowledge graph, which integrates historical states, is as follows: ， in, For the new event graphing function, For historical graph memory functions, This is the memory decay coefficient, which controls the degree to which historical information is retained.
7. The method according to claim 1, characterized in that, The method employs a memory-enhanced temporal variational autoencoder framework to continuously learn and model user access behavior, specifically including: The user's access event sequence is transformed into a behavior sequence fragment, which is then encoded into a distribution in the latent space by a temporal variational autoencoder and sampled to obtain a latent vector. The similarity between the latent vector and the historical normal pattern prototype vector stored in the memory matrix is calculated to obtain the memory matching degree. At the same time, the reconstruction error between the original sequence and the reconstructed sequence is calculated. Calculate the composite anomaly score based on the reconstruction error and the memory matching degree; The composite anomaly score is judged based on a dynamic threshold, and graded intervention is triggered according to the extent of exceeding the limit and the level of operational sensitivity. Using new behavioral sequences that have been confirmed to be normal after a cooling-off observation period, the encoder, decoder parameters, and memory matrix are updated via online learning.
8. The method according to claim 7, characterized in that, The memory matrix is updated using a competitive update mechanism: If the new vector is highly similar to an existing row in the memory matrix, then update the vector in that row to make it closer to the new vector; otherwise, if the new vector is significantly different from all existing rows, then replace the least frequently used row in the memory matrix with it.
9. The method according to claim 1, characterized in that, The high-strength password strategy includes: password length of no less than eight characters, must contain a combination of uppercase and lowercase letters, numbers and special characters, mandatory periodic password change and new passwords must not be repeated with the five most recent historical passwords, and all passwords are transmitted through an encrypted channel based on the national cryptographic algorithm.
10. The method according to claim 1, characterized in that, The centralized auditing and monitoring platform collects logs including user login logs, permission operation records, and system security events. It also sets control rules for login failure scenarios: if the same account fails to log in consecutively a set number of times, it will be automatically locked. The platform provides recovery methods such as manual unlocking by the administrator and automatic unlocking after certain conditions are met.