Computer remote login identification method and system based on artificial intelligence

Abstract

The invention provides a computer remote login identification method and system based on artificial intelligence, and the method comprises the steps: obtaining the initial state data of a target login terminal in response to a remote login request of a user, generating a three-dimensional feature tensor through a graph neural network based on the initial state data, and storing the three-dimensional feature tensor in a database; the three-dimensional feature tensor is used for representing the safety state of the equipment; during the duration of the remote session, acquiring a multi-modal data stream in real time, and performing spatial-temporal feature fusion on the multi-modal data stream to generate a dynamic state vector; performing comparative learning on the three-dimensional feature tensor and the dynamic state vector to generate a risk score; and sending a dynamic identification response instruction to the target login terminal based on the risk score, wherein the dynamic identification response instruction is used for indicating the target login terminal to identify the identity of the current user. By adopting the method, the state information of the target equipment can be continuously acquired in the whole remote session period, and dynamic monitoring and real-time evaluation of security risks are realized.

Description

AI-based computer remote login identification method and system Technical Field

[0001] This invention belongs to the field of computer remote login identification technology, and in particular relates to a computer remote login identification method and system based on artificial intelligence. Background Technology

[0002] With the rapid development of remote work and digital transformation, AI-based remote login identification technology has become an important means of network security protection. This technology analyzes user behavior, device characteristics, and environmental information to authenticate and assess the risk of remote login requests at the moment of login, thereby ensuring the security of information assets. Traditional technologies mainly rely on authentication and environmental detection at the time of login, treating security verification as a one-time event. Once verification is successful, the entire session maintains the initial level of trust.

[0003] However, existing methods lack the ability to continuously monitor the entire session lifecycle after the remote session is established. During a remote session, the target device's environmental state may change dynamically, such as the startup of new processes, the access of external devices, and changes in network connection status. These changes may introduce new security risks. Since traditional login identification methods cannot detect these changes in real time, there are time blind spots in security protection, making it difficult to deal with threats that arise after the session is established. Summary of the Invention

[0004] Therefore, it is necessary to provide an artificial intelligence-based computer remote login identification method and system to address the above-mentioned technical problems. This system can continuously acquire target device status information throughout the entire remote session, enabling dynamic monitoring and real-time assessment of security risks.

[0005] In a first aspect, this application provides a computer remote login identification method based on artificial intelligence, comprising:

[0006] In response to a user's remote login request, the system obtains the initial state data of the target login terminal and generates a three-dimensional feature tensor through a graph neural network. The three-dimensional feature tensor is used to characterize the device's security status.

[0007] During the duration of the remote session, multimodal data streams are acquired in real time, and spatiotemporal features of the multimodal data streams are fused to generate dynamic state vectors;

[0008] Risk scores are generated by comparing and learning three-dimensional feature tensors with dynamic state vectors.

[0009] Based on the risk score, a dynamic identification response instruction is sent to the target login terminal. The dynamic identification response instruction is used to instruct the target login terminal to identify the current user.

[0010] In one embodiment, in response to a user's remote login request, initial state data of the target login terminal is obtained, and a three-dimensional feature tensor is generated through a graph neural network, including:

[0011] The process tree topology, peripheral hardware identifiers, and network connection baseline are obtained through the monitoring agent of the target login terminal.

[0012] The process tree topology is input into the node embedding layer of the graph neural network to generate process resource allocation features;

[0013] Input the peripheral hardware identifiers into the edge convolutional layer of the graph neural network to generate peripheral connection relationship features;

[0014] The network connection baseline is input into the graph pooling layer of the graph neural network to generate network traffic distribution characteristics;

[0015] Tensor splicing is performed on process resource allocation characteristics, peripheral connection relationship characteristics, and network traffic distribution characteristics to generate a three-dimensional feature tensor.

[0016] In one embodiment, the process of acquiring multimodal data streams in real time and performing spatiotemporal feature fusion on the multimodal data streams to generate dynamic state vectors includes:

[0017] The multimodal data stream is preprocessed to obtain standard data, which includes process sequence vectors, peripheral permission matrices, and network time-series spectrograms.

[0018] Perform a one-dimensional depthwise separable convolution operation on the process sequence vector to extract local operation pattern feature fragments;

[0019] Perform multi-head self-attention calculation on the peripheral permission matrix to generate intramodal association weights;

[0020] The peripheral permission matrix is ​​weighted and aggregated based on the intramodal correlation weights to generate a peripheral correlation feature vector.

[0021] Perform dilated spatiotemporal convolution on the network temporal spectrogram to extract spatiotemporal correlation feature maps;

[0022] Local operation mode feature fragments, peripheral correlation feature vectors, and spatiotemporal correlation feature maps are input into the feature fusion gateway and channel-level splicing is performed to obtain fused features.

[0023] The fused features are input into the gated recurrent unit network, and the state transition dependencies are modeled along the time dimension to generate a dynamic state vector.

[0024] In one embodiment, a risk score is generated by comparing and learning a three-dimensional feature tensor with a dynamic state vector, including:

[0025] The three-dimensional feature tensor is processed by a frozen static encoder to generate a reference feature projection.

[0026] Real-time feature projections are generated by processing dynamic state vectors through a trainable dynamic encoder.

[0027] Calculate the cosine similarity metric between the baseline feature projection and the real-time feature projection;

[0028] Calculate the JS divergence metric between the baseline feature projection and the real-time feature projection;

[0029] The cosine similarity metric and the JS divergence metric are input into the fully connected layer for feature fusion to generate the risk deviation coefficient.

[0030] Input the risk deviation coefficient into the residual risk assessment network and output the risk score, which includes process anomaly score, peripheral threat score and network attack score.

[0031] In one embodiment, a dynamic identification response instruction is sent to the target login terminal based on a risk score, including:

[0032] When the abnormal score of a process exceeds the dynamic response threshold, a high-risk process isolation instruction is generated. The high-risk process isolation instruction is used to instruct the target login terminal to suspend the network access permissions of the high-risk process and limit its resource consumption.

[0033] When the external device threat score exceeds the preset high-risk threshold, a device binding secondary authentication command is generated. The device binding secondary authentication command is used to instruct the target login terminal to send a dynamic verification code to the user.

[0034] When the temporal change gradient of the network attack component exceeds the fluctuation threshold, a data acquisition enhancement command is generated. The data acquisition enhancement command is used to instruct the target login terminal to increase the sampling frequency to a preset frequency value.

[0035] Send high-risk process isolation commands, device binding secondary authentication commands, and / or data acquisition enhancement commands to the target login terminal via an encrypted control channel.

[0036] In one embodiment, a dilated spatiotemporal convolution operation is performed on the network temporal spectrogram to extract a spatiotemporal correlation feature map, including:

[0037] Obtain the temporal sequence and spatial matrix of the network temporal spectrogram;

[0038] The time-dimensional features are calculated by performing multi-layer dilated convolution operations on the time-dimensional sequence using the following formula:

[0039]

[0040] in, For the first The time dimension of the layer at any moment Time dimension features It is the ReLU activation function. The kernel size is [size]. For the first The first layer of time convolution kernel One weight parameter, For the first Layer at time eigenvalues, For the first The coefficient of thermal expansion of the layer, For the first Bias term in the time dimension of the layer;

[0041] The spatial dimension features are calculated by performing a two-dimensional convolution operation on the spatial dimension matrix using the following formula:

[0042]

[0043] in, For the first Layer space dimension in position eigenvalues, The size of the spatial convolution kernel. For the m-th spatial convolution kernel at position The weight parameters, For the first Layer in position eigenvalues, For the first The bias term for the layer space dimension;

[0044] A spatiotemporal correlation feature map is obtained by fusion of time-dimensional and spatial-dimensional features.

[0045] In one embodiment, the risk deviation coefficient is input into the residual risk assessment network, and the output risk score includes:

[0046] The first residual module of the residual risk assessment network calculates the process anomaly score based on the risk deviation coefficient and process resource allocation characteristics, as shown in the following formula:

[0047]

[0048] in, Classified as process exceptions, For process feature weight coefficients, To process risk deviation coefficients through multilayer perceptrons The base score obtained For process characteristic residual terms;

[0049] The peripheral threat score is calculated using the second residual module of the residual risk assessment network based on the risk deviation coefficient and peripheral connectivity characteristics, as shown in the following formula:

[0050]

[0051] in, As a peripheral threat segment, These are the peripheral feature weighting coefficients. To process risk deviation coefficients through multilayer perceptrons The base score obtained For peripheral characteristic residuals;

[0052] The network attack score is calculated using the third residual module of the residual risk assessment network, based on the risk deviation coefficient and network traffic distribution characteristics.

[0053]

[0054] in, As a category for network attacks, These are the network feature weight coefficients. To process risk deviation coefficients through multilayer perceptrons The base score obtained For network feature residuals;

[0055] A risk score is generated by weighting and summing the process anomaly score, peripheral threat score, and network attack score using a preset risk weight vector.

[0056] Secondly, this application also provides an artificial intelligence-based computer remote login identification system, comprising:

[0057] The initial feature modeling module is used to respond to the user's remote login request, obtain the initial state data of the target login terminal, and generate a three-dimensional feature tensor through a graph neural network. The three-dimensional feature tensor is used to characterize the device's security status.

[0058] The dynamic feature fusion module is used to acquire multimodal data streams in real time during the duration of a remote session, and to perform spatiotemporal feature fusion on the multimodal data streams to generate dynamic state vectors.

[0059] The risk comparison and assessment module is used to compare and learn the three-dimensional feature tensor with the dynamic state vector to generate a risk score;

[0060] The dynamic response execution module is used to send dynamic identification response instructions to the target login terminal based on risk scores. The dynamic identification response instructions are used to instruct the target login terminal to identify the current user.

[0061] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-mentioned artificial intelligence-based computer remote login identification method.

[0062] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described artificial intelligence-based computer remote login identification method.

[0063] The aforementioned AI-based computer remote login identification method and system acquires the initial state data of the target login terminal upon responding to a remote login request, and uses a graph neural network to generate a three-dimensional feature tensor representing the device's security baseline. During the remote session, it acquires multimodal data streams in real time, and generates a dynamic state vector through spatiotemporal feature fusion, achieving continuous capture of device state information throughout the entire session. Furthermore, it compares and learns the three-dimensional feature tensor with the dynamic state vector to generate a risk score, completing dynamic monitoring and real-time assessment of security risks. Based on the risk score, it sends a dynamic identification response command to the target login terminal, achieving real-time identity recognition of the current user. This technical solution enhances the real-time identification and response capabilities of remote login identification against dynamic security threats. Attached Figure Description

[0064] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0065] Figure 1 is a flowchart illustrating a computer remote login identification method based on artificial intelligence provided in an embodiment of the present invention;

[0066] Figure 2 is a schematic diagram of a computer remote login identification system based on artificial intelligence provided in an embodiment of the present invention. Detailed Implementation

[0067] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0068] First, a brief introduction to the terms used in the embodiments of this application will be given.

[0069] Graph Neural Networks (GNNs) are deep learning models used to process graph-structured data. They capture complex relationships between entities through the aggregation and transmission mechanisms of nodes, edges, and global features. In this solution, its core function is to model heterogeneous data such as device characteristics, network topology, and environmental parameters of the target login terminal into a unified graph structure, thereby generating a three-dimensional feature tensor representing the overall security status of the device, providing a baseline state representation for subsequent dynamic monitoring.

[0070] Contrastive learning is an unsupervised representation learning method that quantifies the deviation of a device's security posture by measuring the similarity difference between a baseline state (a three-dimensional feature tensor) and a real-time state (a dynamic state vector) in the latent space. Its advantage lies in avoiding reliance on predefined rule thresholds, instead adaptively generating risk scores through data-driven similarity calculations, thus adapting to complex and ever-changing attack scenarios.

[0071] Multimodal data stream refers to a collection of heterogeneous time-series data collected in real time during a remote session. It covers multiple sources of information, such as device operation logs, network traffic packets, peripheral access signals, and process behavior sequences. The data stream is continuously updated in the spatiotemporal dimension and is transformed into a unified and analyzable dynamic state vector through a fusion mechanism, providing a real-time input source for full-cycle monitoring.

[0072] Based on the above definitions, the implementation environment of the AI-based computer remote login identification method provided in this application embodiment will be described. Indicatively, the implementation environment includes: a target login terminal, a processor, and a storage device. The processor may be a central processing unit, a graph processor, a multi-core processor, or an AI chip, etc.; the storage device may be a distributed storage device or centralized storage, and is not limited here.

[0073] Based on the above explanations of terms and implementation environments, the application scenarios of the embodiments of this application will be described. The artificial intelligence-based computer remote login identification method provided in the embodiments of this application can be applied to scenarios including but not limited to the following:

[0074] With the acceleration of enterprise digital transformation and the normalization of remote work, employees often access internal office systems via personal terminals, public devices, or remote networks, involving the transmission and processing of sensitive information such as core business data and trade secrets. This application presents an AI-based remote login identification method that responds to employee remote login requests, constructs a device security baseline based on initial state data, continuously monitors the dynamic changes of terminal devices throughout the entire office session, and assesses the security risks of login behavior and device status in real time through comparative learning. In this scenario, the technical solution can accurately identify security threats that may occur during the session, such as unauthorized process initiation and access to unfamiliar peripheral devices, providing full-cycle network security protection for enterprises working remotely.

[0075] Cross-regional collaboration and multi-branch coordination have become commonplace in many industries. Staff in different locations need to access a unified collaborative platform remotely to conduct their work. This results in complex and diverse network environments, varying device types, and dispersed security risks. This technical solution is adaptable to different regional network environments and terminal devices. It quickly establishes device security characteristic benchmarks at the initial login stage, captures multimodal dynamic data in real time during the session, performs feature fusion and risk assessment, and promptly responds to risks such as network connection anomalies and sudden device status changes that may occur during cross-regional logins. It does not rely on a fixed office environment and can flexibly adapt to the dynamic needs of cross-regional collaboration, providing reliable support for login security in distributed work models.

[0076] With the widespread application of cloud services, users' demand for remote login to access cloud servers, cloud storage, and other resources is increasing. The diversity of login terminals, the uncertainty of network environments, and the high value of cloud resources pose greater challenges to login security. The identification method in this application can quickly obtain the initial security state of the terminal and generate a feature tensor when a user logs into a cloud service. It continuously monitors device dynamics and network status throughout the entire cloud service usage session, accurately quantifies the risk level through comparative learning, and triggers dynamic responses. In this scenario, the technical solution can effectively resist security threats such as remote login attacks and session hijacking against cloud services, ensuring the security and compliance of cloud resource access.

[0077] This is merely an illustrative example; the AI-based computer remote login identification method provided in this application embodiment can also be applied to other application scenarios. It is only an example and does not limit the specific application scenarios.

[0078] In an exemplary embodiment, as shown in FIG1, an artificial intelligence-based computer remote login identification method is provided. This embodiment illustrates the application of this method to a target login terminal in the aforementioned implementation environment. It is understood that this method can also be applied to a server, and can also be applied to a system including a terminal and a server, and implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps 101 to 104:

[0079] Step 101: In response to the user's remote login request, obtain the initial state data of the target login terminal, and generate a three-dimensional feature tensor through a graph neural network. The three-dimensional feature tensor is used to characterize the device's security status.

[0080] Specifically, the initial state data originates from the target login terminal's hardware configuration information, basic system operating parameters, preset security configuration items, and initial network connection information, ensuring the data covers the core dimensions of the device's security status. To achieve accurate representation of the initial state data, this technical solution employs a graph neural network to extract and fuse features from the aforementioned multi-dimensional initial state data. Leveraging the graph neural network's ability to model unstructured data, different types of initial state data are mapped to nodes, edges, and attribute information in a graph structure, comprehensively and structurally representing the target login terminal's device security baseline state at the moment of login. For example, the graph neural network can utilize GCN (Graph Convolutional Network) or GAT (Graph Attention Network). Through iterative training of a multi-layered network structure, the generated three-dimensional feature tensor possesses a strong representational ability of the initial security state, providing a reliable benchmark reference for subsequent risk assessment.

[0081] Step 102: During the duration of the remote session, acquire multimodal data streams in real time and perform spatiotemporal feature fusion on the multimodal data streams to generate dynamic state vectors.

[0082] For example, the multimodal data stream encompasses different types of real-time status information, such as process running status data, peripheral access dynamic data, network transmission traffic data, and user operation behavior data. Data acquisition can employ a combination of timed sampling and event-triggered sampling to ensure data real-time performance while avoiding excessive data collection that could lead to system resource consumption. To effectively integrate the spatiotemporal correlation information in the multimodal data stream, this technical solution performs spatiotemporal feature fusion processing. Specifically, it first performs standardization preprocessing on various modal data to eliminate data format differences and dimensional influences. Then, for dynamic change characteristics in the time dimension, it uses time-series modeling methods to capture state evolution patterns. For multimodal data correlation characteristics in the spatial dimension, it uses cross-modal fusion technology to mine potential correlations between different types of data. Through deep fusion of these spatiotemporal features, the multimodal data stream is transformed into a dynamic state vector that reflects the real-time device status. Furthermore, spatiotemporal feature fusion can be achieved by combining attention mechanisms with convolutional neural networks. The attention mechanism allocates weights to different modal data to highlight the contribution of key security information. Then, convolution operations are used to extract local and global information from the fused features, ensuring that the dynamic state vector can accurately depict the real-time changes in the device state during the session.

[0083] Step 103: Compare and learn the three-dimensional feature tensor with the dynamic state vector to generate a risk score.

[0084] Specifically, machine learning algorithms are used to quantify the feature differences between a three-dimensional feature tensor and a dynamic state vector, thereby determining the degree of deviation of the real-time device state from an initial security baseline. Specifically, in the contrastive learning process, the three-dimensional feature tensor and the dynamic state vector are first mapped to the same feature space to ensure the effectiveness of the comparison. The deviation quantification results are obtained by calculating indicators such as feature similarity and distribution differences. Then, based on a pre-defined risk assessment model, this deviation quantification result is converted into a risk score, which can intuitively reflect the security risk level of the current remote session. For example, contrastive learning can adopt a Siamese network architecture, achieving homologous mapping between initial and real-time features through a shared feature extraction layer. The model parameters are optimized through a loss function, enabling the risk score to accurately respond to abnormal changes in the device state, providing a quantitative basis for subsequent security responses.

[0085] Step 104: Send a dynamic identification response instruction to the target login terminal based on the risk score. The dynamic identification response instruction is used to instruct the target login terminal to identify the current user.

[0086] Specifically, the command generation logic corresponds to the risk score level, that is, the strength and method of identity verification are determined according to the risk score, ensuring the targeted and flexible nature of security protection. For example, this method first classifies the risk score according to a preset risk threshold, generates corresponding dynamic identification response commands for different risk levels, and sends the commands to the target login terminal through an encrypted transmission channel to ensure the security of command transmission. After receiving the command, the target login terminal performs the corresponding identity verification operation according to the command requirements, such as performing simple identity verification for low-risk levels and multi-factor authentication for high-risk levels. For example, dynamic identification response commands may include two-factor authentication code verification commands, biometric verification commands, trusted device binding verification commands, etc., dynamically adjusting the identity verification method to ensure network security while also considering the user experience.

[0087] The aforementioned AI-based remote login identification method acquires the initial state data of the target login terminal upon responding to a remote login request, and uses a graph neural network to generate a three-dimensional feature tensor representing the device's security baseline. During the remote session, it acquires multimodal data streams in real time, and generates a dynamic state vector through spatiotemporal feature fusion, achieving continuous capture of device state information throughout the entire session. Furthermore, it compares and learns the three-dimensional feature tensor with the dynamic state vector to generate a risk score, completing dynamic monitoring and real-time assessment of security risks. Based on the risk score, it sends a dynamic identification response command to the target login terminal, achieving real-time identity recognition of the current user. This technical solution enhances the real-time identification and response capabilities of remote login to dynamic security threats.

[0088] In one embodiment, in response to a user's remote login request, initial state data of the target login terminal is obtained, and a three-dimensional feature tensor is generated through a graph neural network, including:

[0089] The process tree topology, peripheral hardware identifiers, and network connection baselines are obtained through the monitoring agent of the target login terminal.

[0090] Specifically, initial state data is obtained through a kernel-level monitoring agent deployed on the target login terminal. This monitoring agent can use system call hooking technology to capture process tree topology relationships, recording process IDs, parent process IDs, and CPU / memory resource usage to form a directed acyclic graph. Simultaneously, it collects peripheral hardware identifiers through the Device Manager interface, including USB device vendor IDs, product hash values, and driver signature certificates. Furthermore, it obtains network connection baselines based on raw socket listening, and statistically analyzes TCP / UDP port status, remote IP reputation values, and traffic fluctuation standard deviations. For example, on the Windows platform, millisecond-level data collection can be achieved through ETW event tracing, ensuring the real-time nature and completeness of state data.

[0091] The process tree topology is input into the node embedding layer of the graph neural network to generate process resource allocation features.

[0092] Specifically, the obtained process tree topology is input into the node embedding layer of the graph neural network. The node embedding layer employs a node representation learning algorithm, such as a variant of the DeepWalk algorithm. In this algorithm, a random walk is performed starting from each process node in the process tree. In each walk, the next node is selected based on the connection probability between nodes. After multiple walks, a sequence of each node is generated. These sequences are then transformed into low-dimensional vector representations using a word vector model, such as the Skip-Gram model, thereby generating vectors that reflect the characteristics of process resource allocation, including information on the process's use and allocation of resources such as CPU and memory.

[0093] The peripheral hardware identifiers are input into the edge convolutional layer of the graph neural network to generate peripheral connection relationship features.

[0094] Specifically, the peripheral hardware identifier is input into the edge convolutional layer for feature extraction. This layer is designed using a relational graph convolutional network. Further, using peripheral devices as nodes and the binding relationship between the device and the host process as edges, the initial edge features include the device insertion timestamp, driver loading order, and interrupt request frequency. These features are then processed by the edge weight learning layer to generate a 64-dimensional peripheral connection feature vector. For example, when an unauthorized dongle is detected, the activation value of this vector in the counterfeit device identification dimension will exceed a preset threshold, achieving early identification of peripheral spoofing attacks.

[0095] The network connection baseline is input into the graph pooling layer of the graph neural network to generate network traffic distribution features.

[0096] Specifically, the graph pooling layer first constructs a graph from network connectivity information, where nodes represent network connection endpoints and edges represent connection links. It then uses max pooling or average pooling strategies to downsample the graph. For example, within a subnet, taking a network connectivity graph of routers and multiple hosts as an example, the pooling operation statistically summarizes the network traffic data of each host within the subnet, generating network traffic distribution characteristics that reflect the traffic distribution and trends in different areas of the network.

[0097] Tensor splicing is performed on process resource allocation characteristics, peripheral connection relationship characteristics, and network traffic distribution characteristics to generate a three-dimensional feature tensor.

[0098] Specifically, the 128-dimensional process features, 64-dimensional peripheral features, and 32-dimensional network features are concatenated along the channel dimensions to form a 224-dimensional composite vector, which is then reshaped into an 80×80×64 three-dimensional feature tensor through a fully connected layer. For example, a high activation value at the tensor space coordinates (32,16) corresponds to an abnormal association pattern between high-risk processes and peripherals, while the peak value of the 48th dimension of the depth channel reflects network port scanning behavior characteristics, thereby constructing a holographic projection of the device's security status in three-dimensional space. This embodiment, through multi-dimensional acquisition and processing of the initial state data of the target login terminal, utilizes a graph neural network to generate a three-dimensional feature tensor that comprehensively reflects the terminal's status. This enables more accurate analysis of the login terminal's operating status, improving the accuracy and comprehensiveness of the system's monitoring and analysis of the login terminal's status, and providing strong support for ensuring the security and stability of remote login.

[0099] In one embodiment, the process of acquiring multimodal data streams in real time and performing spatiotemporal feature fusion on the multimodal data streams to generate dynamic state vectors includes:

[0100] The multimodal data stream is preprocessed to obtain standard data, which includes process sequence vectors, peripheral permission matrices, and network time-series spectrograms.

[0101] Specifically, this method acquires multimodal data streams in real time through various sensors and data acquisition interfaces. These data streams cover multiple types of data, such as process information generated during system operation, peripheral status information, and network transmission data. The acquired multimodal data streams suffer from issues such as inconsistent data formats and noise interference, requiring data preprocessing. A pre-defined parsing algorithm can be used to parse the raw multimodal data streams, separating different types of data components and processing them separately. For example, for process sequence data, a normalization algorithm is used to convert it into a process sequence vector; for peripheral permission-related data, it is organized into a peripheral permission matrix; and for network data, techniques such as Fourier transform are used to generate a network time-series spectrum diagram to obtain standard data, providing a foundation for subsequent processing.

[0102] Perform a one-dimensional depthwise separable convolution operation on the process sequence vector to extract local operation pattern feature fragments.

[0103] Specifically, the one-dimensional depthwise separable convolution operation decomposes traditional convolution into two steps: depthwise convolution and pointwise convolution. First, depthwise convolution is performed, using a specific-sized kernel (e.g., 3×1) for each channel of the process sequence vector. This allows each channel to undergo spatial convolution independently, effectively reducing the number of parameters. Then, pointwise convolution is performed, using a 1×1 kernel to process the output of the depthwise convolution. By linearly combining the output dimensions, information from different channels is fused, thereby extracting local operational pattern feature fragments. These feature fragments effectively reflect the local operational pattern information within the process sequence.

[0104] Perform multi-head self-attention calculation on the peripheral permission matrix to generate intramodal association weights.

[0105] The peripheral permission matrix is ​​weighted and aggregated based on the intramodal correlation weights to generate a peripheral correlation feature vector.

[0106] Specifically, multi-head self-attention computation is performed on the peripheral permission matrix. This involves linearly transforming the matrix to obtain query, key, and value vectors. These vectors are then divided into multiple attention heads, each calculating attention independently. During computation, the attention score is obtained by matrix multiplication using the transpose of the query and key vectors. This score is then scaled by the square root of the key vector's dimension and standardized using a softmax function to obtain the attention weight distribution. This weight distribution is used to weight and sum the value vectors, yielding the output of each attention head. The outputs of multiple attention heads are concatenated and then subjected to a linear transformation to generate intra-modal association weights. Based on these intra-modal association weights, the peripheral permission matrix is ​​weighted and aggregated to highlight important information and de-emphasize secondary information, generating a peripheral association feature vector that reflects the degree of association between peripherals.

[0107] Perform dilated spatiotemporal convolution on the network temporal spectrogram to extract spatiotemporal correlation feature maps.

[0108] Specifically, dilated spatiotemporal convolution is a convolution operation that combines temporal and spatial dimensions. By setting the dilation rate, the receptive field of the convolutional kernel can be expanded, thereby capturing long-range spatiotemporal correlations in the network's temporal spectrogram. This operation can extract patterns of network traffic changes in time and spectrum, such as periodic traffic variations and spectral characteristics of burst traffic. The spatiotemporal correlation feature map generated through dilated spatiotemporal convolution can effectively characterize the dynamic changes in the network environment, providing important spatiotemporal feature information for subsequent feature fusion.

[0109] The local operation mode feature fragments, peripheral correlation feature vectors, and spatiotemporal correlation feature maps are input into the feature fusion gateway and then concatenated at the channel level to obtain the fused features.

[0110] The fused features are input into the gated recurrent unit network, and the state transition dependencies are modeled along the time dimension to generate a dynamic state vector.

[0111] Specifically, in the feature fusion gateway, features from different sources are combined according to the channel dimension to form fused features, which contain information from different aspects of the multimodal data stream. The fused features are then input into a gated recurrent unit network (GRU), which controls the transmission and forgetting of information through a gating mechanism. The GRU models the fused features along the time dimension, learning state transition dependencies, i.e., analyzing the relationships between features at different time steps, and generating a dynamic state vector. This dynamic state vector comprehensively reflects the dynamic changes of the multimodal data stream in the spatiotemporal dimension. This embodiment, through the spatiotemporal feature fusion of multimodal data streams, generates a dynamic state vector, which can comprehensively and in real-time reflect the dynamic security status of the target login terminal during a remote session, improving dynamic monitoring capabilities and security protection effectiveness.

[0112] In one embodiment, a risk score is generated by comparing and learning a three-dimensional feature tensor with a dynamic state vector, including:

[0113] The three-dimensional feature tensor is processed by a frozen static encoder to generate a reference feature projection.

[0114] Specifically, the static encoder is a pre-trained deep learning model whose parameters are frozen after training to ensure a stable representation of the initial state. The encoder's role is to map the three-dimensional feature tensor into a low-dimensional feature space, generate a benchmark feature projection, ensure an accurate description of the initial security state of the target login terminal, and provide a stable benchmark for subsequent comparative learning.

[0115] A trainable dynamic encoder processes the dynamic state vector to generate real-time feature projections.

[0116] Specifically, the dynamic encoder is a trainable deep learning model whose parameters are continuously updated during training to adapt to changes in the dynamic state vector. The encoder's role is to map the dynamic state vector onto a feature space of the same dimension as the baseline feature projection, generating a real-time feature projection. This process effectively captures the dynamic changes of the target login terminal during a remote session and transforms them into a comparable feature representation.

[0117] Calculate the cosine similarity metric between the baseline feature projection and the real-time feature projection.

[0118] Specifically, cosine similarity is a commonly used similarity measurement method. It measures the similarity between two vectors by calculating the cosine value of the angle between them. The range of cosine similarity measurement value is between [-1, 1]. The closer the value is to 1, the more similar the two feature projections are, and the closer the value is to -1, the less similar they are.

[0119] Calculate the JS divergence metric between the baseline feature projection and the real-time feature projection.

[0120] Specifically, JS divergence (Jensen-Shannon Divergence) is a metric for measuring the difference between two probability distributions. It is based on the symmetric processing of KL divergence (Kullback-Leibler Divergence), exhibiting non-negativity and symmetry. The JS divergence value ranges between [0,1]. A value closer to 0 indicates greater similarity between the two feature projections, while a value closer to 1 indicates less similarity. By calculating the JS divergence value, the difference between the baseline feature projection and the real-time feature projection can be quantified from the perspective of probability distribution, providing a more comprehensive reference for subsequent risk assessment.

[0121] The cosine similarity metric and JS divergence metric are input into the fully connected layer for feature fusion to generate the risk deviation coefficient.

[0122] Specifically, the cosine similarity metric and the JS divergence metric are input into the fully connected layer for feature fusion. Each neuron in the fully connected layer is connected to all neurons in the input layer. The two input metrics are linearly transformed through a weight matrix and nonlinearly processed using an activation function (such as the ReLU function). This fuses the two different dimensions of feature information into a comprehensive risk deviation coefficient, which comprehensively reflects the degree of difference between the dynamic state and the baseline state in terms of feature direction and probability distribution.

[0123] Input the risk deviation coefficient into the residual risk assessment network and output the risk score, which includes process anomaly score, peripheral threat score and network attack score.

[0124] For example, the risk deviation coefficient is input into a residual risk assessment network. This network, by constructing residual blocks, addresses the vanishing and exploding gradient problems in deep neural network training, enabling the network to learn more complex features and mapping relationships. It further analyzes and transforms the risk deviation coefficient, outputting a risk score, including process anomaly scores, peripheral threat scores, and network attack scores. These scores quantify the degree of risk faced by the target object in different aspects, providing comprehensive and detailed results for risk assessment. This embodiment ensures baseline stability through a frozen encoder, captures real-time changes through a dynamic encoder, and achieves multi-dimensional risk quantification through dual-metric comparative learning. Combined with deep feature extraction from the residual network, it significantly improves the accuracy of identifying complex attacks while ensuring real-time assessment, providing fine-grained decision-making basis for dynamic security responses.

[0125] In one embodiment, a dynamic identification response instruction is sent to the target login terminal based on a risk score, including:

[0126] When the abnormal score of a process exceeds the dynamic response threshold, a high-risk process isolation instruction is generated. The high-risk process isolation instruction is used to instruct the target login terminal to suspend the network access permissions of the high-risk process and limit its resource consumption.

[0127] Specifically, the abnormal process score is compared in real time with a preset dynamic response threshold. The dynamic response threshold can be dynamically adjusted based on historical abnormal process data and system security level requirements through statistical learning algorithms, possessing the ability to adapt to environmental changes. When the abnormal process score exceeds the dynamic response threshold, it indicates that the target login terminal has a high-risk process running at risk, which may lead to information leakage or system intrusion. At this time, the method generates a high-risk process isolation instruction. This instruction includes key information such as the high-risk process identifier to be isolated, the scope of network access restrictions, and resource consumption thresholds. It can instruct the target login terminal to accurately locate the high-risk process, suspend its connection with the external network, and limit its consumption of core resources such as CPU, memory, and storage through the system resource scheduling mechanism. This blocks the spread of harm from the high-risk process from both the propagation path and the operational foundation, ensuring the normal operation of the terminal's core functions.

[0128] When the external device threat score exceeds the preset high-risk threshold, a device binding secondary authentication command is generated. This command instructs the target login terminal to send a dynamic verification code to the user.

[0129] Specifically, the peripheral threat score is compared with a preset high-risk threshold. This threshold is set based on the peripheral type, terminal security policy, and historical threat event data, allowing for flexible adaptation to different application scenarios. When the peripheral threat score exceeds the preset high-risk threshold, it indicates that the currently accessed peripheral may be an unauthorized device or carry malicious programs, posing security risks such as data theft and virus implantation. In this case, the method generates a device binding secondary authentication command. This command specifies the secondary authentication method, verification timeframe, and trusted receiving channel, instructing the target login terminal to send a dynamic verification code through a pre-bound trusted channel. The dynamic verification code can be generated using a time synchronization algorithm, a random number generation algorithm, and device feature information, possessing the characteristics of being one-time and highly time-sensitive. Users must enter the correct verification code to continue using the peripheral's functions. This secondary identity verification confirms the user's legitimacy and effectively resists security threats from peripheral access.

[0130] When the temporal change gradient of the network attack component exceeds the fluctuation threshold, a data acquisition enhancement command is generated. The data acquisition enhancement command is used to instruct the target login terminal to increase the sampling frequency to a preset frequency value.

[0131] Specifically, by calculating the temporal gradient of network attack scores within a continuous time window, this method captures the evolutionary trend of network attack risks. The calculation of the temporal gradient is based on the ratio of the difference in network attack scores between adjacent time nodes to the time interval, which can accurately reflect the rate and intensity of risk changes. This method compares the temporal gradient of network attack scores with a fluctuation threshold, which is determined by analyzing the range of attack score changes under normal network conditions, filtering out false positives caused by minor fluctuations. When the temporal gradient exceeds the fluctuation threshold, it indicates that the network attack risk faced by the target login terminal is rapidly escalating, potentially indicating persistent and high-intensity network attack behavior. This method then generates a data collection enhancement instruction. This instruction includes the sampling frequency increase ratio, the types of network data to be collected, and data storage strategies, instructing the target login terminal to increase its original network data sampling frequency to a preset value. The preset frequency value must balance data collection integrity and terminal performance. By increasing the sampling point density, the method comprehensively captures the characteristic data of network attacks, providing sufficient data support for subsequent attack tracing, threat analysis, and defense strategy optimization.

[0132] Send high-risk process isolation commands, device binding secondary authentication commands, and / or data acquisition enhancement commands to the target login terminal via an encrypted control channel.

[0133] Specifically, after generating high-risk process isolation commands, device binding secondary authentication commands, and / or data acquisition enhancement commands, the commands must be sent to the target login terminal via an encrypted control channel to ensure the security and integrity of the command transmission process and prevent the commands from being tampered with, intercepted, or forged. The encrypted control channel can be constructed using symmetric encryption algorithms, asymmetric encryption algorithms, or hybrid encryption algorithms. For example, it can combine AES symmetric encryption to encrypt the command content, exchange symmetric keys using RSA asymmetric encryption, and simultaneously use digital signature technology to verify the command signature, ensuring that the recipient can confirm the sender's identity and that the command content has not been tampered with. After receiving the command, the target login terminal parses the relevant parameters according to the command type and executes the corresponding security protection operations, achieving accurate responses to different types of security risks. This technical solution, through a dynamic identification and response mechanism based on risk scoring, can generate corresponding response commands according to different types of threats. High-risk process isolation commands, device binding secondary authentication commands, and data acquisition enhancement commands respectively address process anomalies, peripheral device threats, and network attacks, effectively improving the system's security and dynamic response capabilities. Sending commands via an encrypted control channel further enhances system security, ensuring reliable transmission and execution of commands.

[0134] In one embodiment, a dilated spatiotemporal convolution operation is performed on the network temporal spectrogram to extract a spatiotemporal correlation feature map, including:

[0135] Obtain the time-dimensional sequence and spatial-dimensional matrix of the network temporal spectrogram.

[0136] Specifically, a network time-series spectrogram is a visual representation of network traffic data obtained after signal processing such as Fourier transform. It includes the traffic change trend in the time dimension and the frequency distribution information in the spatial dimension. This method extracts the time dimension sequence and spatial dimension matrix of the network time-series spectrogram using a dimension separation algorithm. The time dimension sequence records the spectral intensity data at different times, indexed by the time axis, while the spatial dimension matrix represents the distribution pattern of the spectrum in the frequency domain. Both respectively carry the temporal evolution characteristics and spatial distribution characteristics of network traffic, laying the data foundation for subsequent dimensional feature extraction.

[0137] The time-dimensional features are calculated by performing multi-layer dilated convolution operations on the time-dimensional sequence using the following formula:

[0138]

[0139] in, For the first The time dimension of the layer at any moment Time dimension features It is the ReLU activation function. The kernel size is [size]. For the first The first layer of time convolution kernel One weight parameter, For the first Layer at time eigenvalues, For the first The coefficient of thermal expansion of the layer, For the first Bias term in the time dimension of the layer.

[0140] Specifically, this method performs multi-layer dilated convolution operations on the time-dimensional sequence to compute time-dimensional features, thereby capturing long-term temporal dependencies. In this formula, the first... The dilation coefficient of a layer determines the receptive field of the convolutional kernel. An exponential growth strategy can be used to set the dilation coefficient, allowing the receptive field of each convolutional layer to expand geometrically, thus covering sequence information over longer time spans without increasing the number of parameters. During computation, this method will... The weight parameters of the time convolution kernel in each layer are related to the first layer. The eigenvalues ​​at the corresponding time offset positions of each layer are multiplied, and all product results are summed and then superimposed with the bias term of the time dimension of that layer. A nonlinear transformation is then performed using the ReLU activation function to obtain the ... The feature values ​​of the time dimension at the corresponding time point. This multi-layer dilated convolution operation can effectively mine the long-period correlation patterns hidden in the time dimension sequence, avoiding the problem of traditional convolution's insufficient capture of long time series data. The generated time dimension features accurately reflect the dynamic changes of network traffic over time.

[0141] The spatial dimension features are calculated by performing a two-dimensional convolution operation on the spatial dimension matrix using the following formula:

[0142]

[0143] in, For the first Layer space dimension in position eigenvalues, The size of the spatial convolution kernel. For the m-th spatial convolution kernel at position The weight parameters, For the first Layer in position eigenvalues, For the first The bias term for the layer space dimension.

[0144] Specifically, in this formula, the spatial convolution kernel is constructed according to a preset size, and the weight parameters at each location are optimized and determined through the training process to capture feature patterns of different local regions in the spatial dimension matrix. During calculation, this method will... The weight parameters of the spatial convolution kernel at each position are related to the first... The eigenvalues ​​at the corresponding offset positions of the layer space dimension matrix are multiplied and summed, and then the bias term of the layer space dimension is added. After nonlinear mapping through the ReLU activation function, the result is obtained. The feature values ​​of the layer spatial dimension at the corresponding positions. Two-dimensional convolution operations can effectively aggregate the correlation information of adjacent frequency components in the spatial dimension matrix, highlight the spatial distribution characteristics in the spectrogram, and the generated spatial dimension features clearly present the distribution differences and correlation structures of network traffic in the frequency domain.

[0145] A spatiotemporal correlation feature map is obtained by fusion of time-dimensional and spatial-dimensional features.

[0146] Specifically, in the dot product fusion process, this method performs element-wise multiplication of the temporal dimension feature vector and the spatial dimension feature matrix according to their corresponding dimensions, so that the features of each spatial location are integrated with the corresponding temporal dynamic information, realizing deep coupling of spatiotemporal features. This fully preserves the dynamic evolution characteristics of the temporal dimension and the distribution correlation characteristics of the spatial dimension, breaks the limitations of single-dimensional features, and generates a spatiotemporal correlation feature map that comprehensively depicts the collaborative change pattern of network traffic in the spatiotemporal dimension, providing richer and more accurate feature support for subsequent risk assessment.

[0147] In one embodiment, the risk deviation coefficient is input into the residual risk assessment network, and the output risk score includes:

[0148] The first residual module of the residual risk assessment network calculates the process anomaly score based on the risk deviation coefficient and process resource allocation characteristics, as shown in the following formula:

[0149]

[0150] in, Classified as process exceptions, For process feature weight coefficients, To process risk deviation coefficients through multilayer perceptrons The base score obtained This represents the process characteristic residual term.

[0151] Specifically, the residual risk assessment network consists of multiple residual modules, each responsible for processing a specific type of feature and calculating the corresponding risk score. Through this structural design, the network can effectively learn the complex relationships between features and utilize the residual learning mechanism to improve the model's training efficiency and accuracy. This indicates a process anomaly score, used to measure potential abnormal risks in the process behavior of the target login terminal. It is the process feature weighting coefficient, used to balance the contribution ratio of the base score and the residual term. Risk deviation coefficient is processed through a multilayer perceptron (MLP). The resulting base score is obtained from an MLP, a type of feedforward neural network that learns the non-linear mapping between input features and output. This is the process feature residual term, representing supplementary information beyond the base score, which helps the model capture more subtle feature differences. Through this weighted combination, the first residual module can comprehensively consider the risk deviation coefficient and process resource allocation characteristics to generate accurate process anomaly scores.

[0152] The peripheral threat score is calculated using the second residual module of the residual risk assessment network based on the risk deviation coefficient and peripheral connectivity characteristics, as shown in the following formula:

[0153]

[0154] in, As a peripheral threat segment, These are the peripheral feature weighting coefficients. To process risk deviation coefficients through multilayer perceptrons The base score obtained This refers to the residual term of the peripheral characteristics.

[0155] Specifically, The peripheral threat score measures the potential security threats to the target login terminal in terms of its connection to external devices. It is the peripheral feature weight coefficient, used to adjust the weights of the base score and residual terms. Risk deviation coefficient is processed through multilayer perceptron. The obtained baseline score reflects the correlation between peripheral connection characteristics and risk deviation coefficient. The peripheral feature residual term provides additional feature information, which helps improve the accuracy of the peripheral threat score. In this way, the second residual module can combine the risk deviation coefficient and peripheral connectivity features to generate a reliable peripheral threat score.

[0156] The network attack score is calculated using the third residual module of the residual risk assessment network, based on the risk deviation coefficient and network traffic distribution characteristics.

[0157]

[0158] in, As a category for network attacks, These are the network feature weight coefficients. To process risk deviation coefficients through multilayer perceptrons The base score obtained This represents the network feature residual term.

[0159] Similarly, the third residual module targets network attack analysis. The calculation also generates network-related basic scores through a multilayer perceptron. Based on the deviation between the network traffic distribution characteristics and the normal time-series baseline, a network feature residual term is constructed. The network attack score is obtained by weighted fusion of the network feature weight coefficients. This design effectively alleviates the gradient vanishing problem in deep network training through the residual structure, ensuring the full learning of network risk features.

[0160] A risk score is generated by weighting and summing the process anomaly score, peripheral threat score, and network attack score using a preset risk weight vector.

[0161] Specifically, this method uses a preset risk weight vector to perform a weighted summation of process anomaly scores, peripheral threat scores, and network attack scores to generate a comprehensive risk score. The risk weight vector can be flexibly configured according to the security requirements of the actual application scenario, enabling differentiated emphasis on different dimensions of risk. This embodiment utilizes a residual learning mechanism, which effectively improves the model's learning and generalization abilities. Simultaneously, through a multilayer perceptron and weighted summation, it comprehensively considers multiple features and risk types to generate an accurate risk score. This risk assessment method has high accuracy and reliability, providing strong support for the security protection of remote login.

[0162] In summary, the AI-based computer remote login identification method provided in this application, in response to a remote login request, obtains initial state data such as process tree topology and peripheral hardware identifiers through the monitoring agent of the target login terminal. It then uses a graph neural network to extract features hierarchically and generate a three-dimensional feature tensor representing the device's security baseline. During the remote session, it collects multimodal data streams in real time. After preprocessing, it extracts single-modal features using techniques such as one-dimensional depthwise separable convolution, multi-head self-attention computation, and dilated spatiotemporal convolution. Finally, it performs channel-level stitching and gated recurrent unit network modeling. A dynamic state vector reflecting the real-time status of the device is generated. The 3D feature tensor and dynamic state vector are processed by a frozen static encoder and a trainable dynamic encoder respectively to obtain the baseline and real-time feature projections. The cosine similarity and JS divergence of the two are calculated and fused to generate a risk deviation coefficient. Then, a residual risk assessment network, combined with fine-grained feature residual terms, outputs process anomaly scores, peripheral threat scores, and network attack scores. Based on the risk scores of each dimension, targeted dynamic identification and response instructions are generated and sent to the target login terminal through an encrypted control channel to instruct the target login terminal to perform dynamic security status identification and response. This technical solution eliminates security monitoring blind spots after the login session is established, ensuring the continuity of identity verification while achieving real-time identification and blocking of dynamic changes in the device environment and new threats. It provides comprehensive and refined protection for information asset security in remote office scenarios.

[0163] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0164] Based on the same inventive concept, this application also provides an AI-based computer remote login identification system 10 for implementing the AI-based computer remote login identification method described above. The solution provided by this system is similar to the implementation described in the above method. Therefore, the specific limitations of one or more embodiments of the AI-based computer remote login identification system 10 provided below can be found in the limitations of the AI-based computer remote login identification method described above, and will not be repeated here.

[0165] In an exemplary embodiment, as shown in FIG2, an artificial intelligence-based computer remote login identification system 10 is provided, comprising:

[0166] The initial feature modeling module 11 is used to respond to the user's remote login request, obtain the initial state data of the target login terminal, and generate a three-dimensional feature tensor through a graph neural network. The three-dimensional feature tensor is used to characterize the device's security status.

[0167] The dynamic feature fusion module 12 is used to acquire multimodal data streams in real time during the duration of a remote session, and to perform spatiotemporal feature fusion on the multimodal data streams to generate dynamic state vectors.

[0168] The risk comparison and assessment module 13 is used to compare and learn the three-dimensional feature tensor with the dynamic state vector to generate a risk score;

[0169] The dynamic response execution module 14 is used to send a dynamic identification response instruction to the target login terminal based on the risk score. The dynamic identification response instruction is used to instruct the target login terminal to identify the current user.

[0170] In one embodiment, the initial feature modeling module 11 includes:

[0171] The data acquisition unit is used to obtain process tree topology, peripheral hardware identifiers, and network connection baselines through the monitoring agent of the target login terminal;

[0172] The process feature extraction unit is used to input the process tree topology into the node embedding layer of the graph neural network to generate process resource allocation features;

[0173] The peripheral feature extraction unit is used to input peripheral hardware identifiers into the edge convolutional layer of the graph neural network to generate peripheral connection relationship features;

[0174] The network feature extraction unit is used to input the network baseline into the graph pooling layer of the graph neural network to generate network traffic distribution features.

[0175] The feature splicing unit is used to splice tensors of process resource allocation features, peripheral connection relationship features and network traffic distribution features to generate a three-dimensional feature tensor.

[0176] In one embodiment, the dynamic feature fusion module 12 includes:

[0177] The data preprocessing unit is used to preprocess the multimodal data stream to obtain standard data, which includes process sequence vectors, peripheral permission matrices, and network time-series spectrum diagrams.

[0178] The process feature extraction unit is used to perform a one-dimensional depthwise separable convolution operation on the process sequence vector to extract local operation pattern feature fragments.

[0179] The peripheral association weight generation unit is used to perform multi-head self-attention calculation on the peripheral permission matrix to generate intramodal association weights.

[0180] The peripheral feature aggregation unit is used to perform weighted aggregation of the peripheral permission matrix based on the intramodal correlation weights to generate a peripheral correlation feature vector.

[0181] The spatiotemporal feature extraction unit is used to perform dilated spatiotemporal convolution operations on the network temporal spectrogram to extract spatiotemporal correlation feature maps.

[0182] The feature fusion unit is used to input local operation mode feature fragments, peripheral correlation feature vectors and spatiotemporal correlation feature maps into the feature fusion gateway, and perform channel-level splicing to obtain fused features;

[0183] The state vector generation unit is used to input fused features into the gated recurrent unit network, model state transition dependencies along the time dimension, and generate dynamic state vectors.

[0184] In one embodiment, the risk comparison and assessment module 13 includes:

[0185] A static encoding unit is used to process the 3D feature tensor through a frozen static encoder to generate a reference feature projection.

[0186] The dynamic encoding unit is used to process dynamic state vectors through a trainable dynamic encoder to generate real-time feature projections.

[0187] The similarity calculation unit is used to calculate the cosine similarity metric between the baseline feature projection and the real-time feature projection.

[0188] The divergence calculation unit is used to calculate the JS divergence metric between the baseline feature projection and the real-time feature projection.

[0189] The deviation coefficient generation unit is used to input the cosine similarity metric and JS divergence metric into the fully connected layer for feature fusion and generate the risk deviation coefficient.

[0190] The risk assessment unit is used to input the risk deviation coefficient into the residual risk assessment network and output a risk score, which includes process anomaly score, peripheral threat score, and network attack score.

[0191] In one embodiment, the dynamic response execution module 14 includes:

[0192] The process isolation instruction generation unit is used to generate a high-risk process isolation instruction when the abnormal process score exceeds the dynamic response threshold. The high-risk process isolation instruction is used to instruct the target login terminal to suspend the network access permissions of the high-risk process and limit its resource consumption.

[0193] The secondary authentication command generation unit is used to generate a device binding secondary authentication command when the external device threat score exceeds a preset high-risk threshold. The device binding secondary authentication command is used to instruct the target login terminal to send a dynamic verification code to the user.

[0194] The sampling enhancement instruction generation unit is used to generate a data acquisition enhancement instruction when the temporal change gradient of the network attack component exceeds the fluctuation threshold. The data acquisition enhancement instruction is used to instruct the target login terminal to increase the sampling frequency to a preset frequency value.

[0195] The instruction sending unit is used to send high-risk process isolation instructions, device binding secondary authentication instructions, and / or data acquisition enhancement instructions to the target login terminal through an encrypted control channel.

[0196] In one embodiment, the spatiotemporal feature extraction unit is used to perform the following steps:

[0197] Obtain the temporal sequence and spatial matrix of the network temporal spectrogram;

[0198] The time-dimensional features are calculated by performing multi-layer dilated convolution operations on the time-dimensional sequence using the following formula:

[0199]

[0200] in, For the first The time dimension of the layer at any moment Time dimension features It is the ReLU activation function. The kernel size is [size]. For the first The first layer of time convolution kernel One weight parameter, For the first Layer at time eigenvalues, For the first The coefficient of thermal expansion of the layer, For the first Bias term in the time dimension of the layer;

[0201] The spatial dimension features are calculated by performing a two-dimensional convolution operation on the spatial dimension matrix using the following formula:

[0202]

[0203] in, For the first Layer space dimension in position eigenvalues, The size of the spatial convolution kernel. For the m-th spatial convolution kernel at position The weight parameters, For the first Layer in position eigenvalues, For the first The bias term for the layer space dimension;

[0204] A spatiotemporal correlation feature map is obtained by fusion of time-dimensional and spatial-dimensional features.

[0205] In one embodiment, the risk assessment unit is used to perform the following steps, including:

[0206] The first residual module of the residual risk assessment network calculates the process anomaly score based on the risk deviation coefficient and process resource allocation characteristics, as shown in the following formula:

[0207]

[0208] in, Classified as process exceptions, For process feature weight coefficients, To process risk deviation coefficients through multilayer perceptrons The base score obtained For process characteristic residual terms;

[0209] The peripheral threat score is calculated using the second residual module of the residual risk assessment network based on the risk deviation coefficient and peripheral connectivity characteristics, as shown in the following formula:

[0210]

[0211] in, As a peripheral threat segment, These are the peripheral feature weighting coefficients. To process risk deviation coefficients through multilayer perceptrons The base score obtained For peripheral characteristic residuals;

[0212] The network attack score is calculated using the third residual module of the residual risk assessment network, based on the risk deviation coefficient and network traffic distribution characteristics.

[0213]

[0214] in, As a category for network attacks, These are the network feature weight coefficients. To process risk deviation coefficients through multilayer perceptrons The base score obtained For network feature residuals;

[0215] A risk score is generated by weighting and summing the process anomaly score, peripheral threat score, and network attack score using a preset risk weight vector.

[0216] In one embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of the artificial intelligence-based computer remote login identification method described above.

[0217] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0218] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The components described as separate parts may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this disclosure according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0219] The above-described embodiments are merely illustrative of several implementation methods of the embodiments of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the embodiments of this application, and these modifications and improvements all fall within the protection scope of the embodiments of this application.

Claims

1. A computer remote login identification method based on artificial intelligence, characterized in that, The method includes: in response to a user's remote login request, acquiring initial state data of the target login terminal, and generating a three-dimensional feature tensor based on the initial state data using a graph neural network, wherein the three-dimensional feature tensor is used to characterize the device's security status; during the duration of the remote session, acquiring a multimodal data stream in real time, and performing spatiotemporal feature fusion on the multimodal data stream to generate a dynamic state vector; comparing and learning the three-dimensional feature tensor with the dynamic state vector to generate a risk score; and sending a dynamic identification response instruction to the target login terminal based on the risk score, wherein the dynamic identification response instruction is used to instruct the target login terminal to identify the current user.

2. The method according to claim 1, characterized in that, The process of responding to a user's remote login request, obtaining initial state data of the target login terminal, and generating a three-dimensional feature tensor through a graph neural network includes: obtaining process tree topology, peripheral hardware identifiers, and network connection baselines through the monitoring agent of the target login terminal; inputting the process tree topology into the node embedding layer of the graph neural network to generate process resource allocation features; inputting the peripheral hardware identifiers into the edge convolutional layer of the graph neural network to generate peripheral connection features; inputting the network connection baseline into the graph pooling layer of the graph neural network to generate network traffic distribution features; and concatenating the process resource allocation features, the peripheral connection features, and the network traffic distribution features into tensors to generate the three-dimensional feature tensor.

3. The method according to claim 2, characterized in that, The real-time acquisition of multimodal data streams and the spatiotemporal feature fusion of the multimodal data streams to generate dynamic state vectors include: preprocessing the multimodal data streams to obtain standard data, which includes process sequence vectors, peripheral permission matrices, and network temporal spectrograms; performing a one-dimensional depthwise separable convolution operation on the process sequence vectors to extract local operation mode feature fragments; performing multi-head self-attention calculation on the peripheral permission matrix to generate intramodal correlation weights; performing weighted aggregation on the peripheral permission matrix based on the intramodal correlation weights to generate peripheral correlation feature vectors; performing dilated spatiotemporal convolution on the network temporal spectrograms to extract spatiotemporal correlation feature maps; inputting the local operation mode feature fragments, the peripheral correlation feature vectors, and the spatiotemporal correlation feature maps into a feature fusion gateway for channel-level concatenation to obtain fused features; and inputting the fused features into a gated recurrent unit network to model state transition dependencies along the time dimension to generate the dynamic state vector.

4. The method according to claim 2, characterized in that, The step of comparing and learning the three-dimensional feature tensor with the dynamic state vector to generate a risk score includes: processing the three-dimensional feature tensor through a frozen static encoder to generate a baseline feature projection; processing the dynamic state vector through a trainable dynamic encoder to generate a real-time feature projection; calculating the cosine similarity metric between the baseline feature projection and the real-time feature projection; calculating the JS divergence metric between the baseline feature projection and the real-time feature projection; inputting the cosine similarity metric and the JS divergence metric into a fully connected layer for feature fusion to generate a risk deviation coefficient; and inputting the risk deviation coefficient into a residual risk assessment network to output the risk score, which includes a process anomaly score, a peripheral threat score, and a network attack score.

5. The method according to claim 4, characterized in that, The step of sending a dynamic identification response instruction to the target login terminal based on the risk score includes: when the process anomaly score exceeds a dynamic response threshold, generating a high-risk process isolation instruction, which instructs the target login terminal to suspend network access permissions for the high-risk process and restrict resource usage; when the peripheral device threat score exceeds a preset high-risk threshold, generating a device binding secondary authentication instruction, which instructs the target login terminal to send a dynamic verification code to the user; when the temporal change gradient of the network attack score exceeds a fluctuation threshold, generating a data collection enhancement instruction, which instructs the target login terminal to increase the sampling frequency to a preset frequency value; and sending the high-risk process isolation instruction, the device binding secondary authentication instruction, and / or the data collection enhancement instruction to the target login terminal through an encrypted control channel.

6. The method according to claim 3, characterized in that, The step of performing dilated spatiotemporal convolution on the network temporal spectrogram to extract spatiotemporal correlation feature maps includes: obtaining the temporal dimension sequence and spatial dimension matrix of the network temporal spectrogram; and calculating the temporal dimension features by performing multi-layer dilated convolution on the temporal dimension sequence using the following formula: in, For the first The time dimension of the layer at any moment The aforementioned time dimension features, It is the ReLU activation function. The kernel size is [size]. For the first The first layer of time convolution kernel One weight parameter, For the first Layer at time eigenvalues, For the first The coefficient of thermal expansion of the layer, For the first The bias term of the time dimension of the layer; the spatial dimension features are calculated by performing a two-dimensional convolution operation on the spatial dimension matrix using the following formula: in, For the first Layer space dimension in position eigenvalues, The size of the spatial convolution kernel. For the m-th spatial convolution kernel at position The weight parameters, For the first Layer in position eigenvalues, For the first The bias term of the spatial dimension is used; the spatiotemporal correlation feature map is obtained by performing dot product fusion based on the temporal dimension features and the spatial dimension features.

7. The method according to claim 4, characterized in that, The step of inputting the risk deviation coefficient into the residual risk assessment network and outputting the risk score includes: calculating the process anomaly score based on the risk deviation coefficient and the process resource allocation characteristics through the first residual module of the residual risk assessment network, as shown in the following formula: in, The process is classified as abnormal. For process feature weight coefficients, To process the risk deviation coefficient through a multilayer perceptron The base score obtained The process characteristic residual term; through the second residual module of the residual risk assessment network, the peripheral threat score is calculated based on the risk deviation coefficient and the peripheral connection relationship characteristics, as shown in the following formula: in, The peripheral threat is divided into, These are the peripheral feature weighting coefficients. This is the base score obtained by processing the risk deviation coefficient C through a multilayer perceptron. The residual term represents the peripheral characteristics; the network attack score is calculated using the third residual module of the residual risk assessment network based on the risk deviation coefficient and the network traffic distribution characteristics. in, The network attack is categorized as follows: These are the network feature weight coefficients. To process the risk deviation coefficient through a multilayer perceptron The base score obtained The network feature residual term is used; the risk score is generated by weighting and summing the process anomaly score, the peripheral threat score, and the network attack score using a preset risk weight vector.

8. A computer remote login identification system based on artificial intelligence, characterized in that, The system includes: an initial feature modeling module, used to respond to a user's remote login request, acquire initial state data of the target login terminal, and generate a three-dimensional feature tensor through a graph neural network, wherein the three-dimensional feature tensor is used to characterize the device's security status; a dynamic feature fusion module, used to acquire multimodal data streams in real time during the duration of the remote session, and perform spatiotemporal feature fusion on the multimodal data streams to generate a dynamic state vector; a risk comparison and assessment module, used to compare and learn the three-dimensional feature tensor with the dynamic state vector to generate a risk score; and a dynamic response execution module, used to send a dynamic identification response instruction to the target login terminal based on the risk score, wherein the dynamic identification response instruction is used to instruct the target login terminal to identify the current user.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.

Images