An ai intelligent terminal fingerprint verification system based on multi-dimensional baseline

Abstract

The application provides an AI intelligent terminal fingerprint verification system based on multi-dimensional baseline, relates to the technical field of intelligent identity authentication, and the hardware features, software environment and network environment of a terminal device are collected and fused in multiple sources to generate a unique terminal identifier, and a fingerprint credibility evaluation mechanism is constructed in combination with historical fingerprint data; meanwhile, a dynamic baseline is constructed in time, region, terminal and behavior dimensions based on user login behavior, and the current login behavior is processed by feature vectorization. Further, by calculating the scene deviation index, the behavior anomaly index and the comprehensive risk score, the quantification analysis of the login behavior is realized, and the differentiated security control strategy is executed in combination with the graded risk threshold. The method can effectively improve the accuracy of terminal identity recognition and the risk judgment ability of login behavior, reduce the risk of abnormal access and attack, and improve the overall security protection level of the system.

Description

Technical Field

[0001] This invention relates to the field of intelligent identity authentication technology, specifically to an AI-powered intelligent terminal fingerprint verification system based on a multi-dimensional baseline. Background Technology

[0002] With the rapid development of internet services, traditional account and password-based authentication methods are no longer sufficient to meet the security needs of complex network environments. This is especially true in scenarios such as remote login, cross-regional access, and multi-terminal access, where issues such as account theft, terminal spoofing, and abnormal login behavior are difficult to identify in a timely manner. Existing technologies typically verify user identity through terminal fingerprint recognition or single behavioral feature analysis, but these methods still have significant shortcomings in practical applications.

[0003] Traditional terminal fingerprint technology relies heavily on static features for matching, lacking the ability to dynamically model fingerprint changes over time, making it difficult to effectively identify fingerprint tampering or forgery. On the other hand, while some solutions introduce behavioral analysis methods, they are mostly focused on a single dimension, such as login time or IP address, lacking comprehensive modeling of user login behavior across multiple dimensions such as time, region, terminal, and operational behavior, resulting in limited ability to identify complex and abnormal scenarios.

[0004] Existing risk control mechanisms typically use fixed rules or static thresholds for judgment, lacking the ability to adapt to users' historical behavior patterns and easily affected by abnormal data, thus impacting the accuracy of judgments. At the same time, in terms of risk handling, a uniform strategy is often adopted, making it difficult to implement differentiated control based on different risk levels, thereby reducing the overall protection effectiveness of the system. Summary of the Invention

[0005] The purpose of this invention is to provide an AI-powered smart terminal fingerprint verification system based on a multi-dimensional baseline, in order to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: An AI-powered smart terminal fingerprint verification system based on multi-dimensional baselines includes: The terminal fingerprint identification construction module is used to collect and standardize the hardware feature information, software environment information and network environment information of the terminal device from multiple sources, and generate a unique terminal identifier through multi-dimensional feature fusion and hash mapping to establish the binding relationship between user account and terminal. The fingerprint trustworthiness assessment module is used to calculate the fingerprint trustworthiness index and compare it with the trustworthiness threshold to determine whether the current terminal fingerprint is trustworthy. If it is, the current fingerprint feature vector and the corresponding terminal identifier are written into the trustworthy fingerprint set; if not, the current fingerprint feature vector and the terminal identifier are written into the abnormal fingerprint set, and security control policies are executed. The multidimensional login baseline construction module is used to perform statistical analysis and feature extraction on user login behavior in terms of time, region, terminal and behavior dimensions, construct time baseline, region baseline, terminal baseline and behavior baseline, and dynamically optimize and structure each baseline through sliding time window and incremental update mechanism. The login feature construction module is used to collect login context data such as the current terminal fingerprint information, login time, login region and IP reputation level when receiving a login request, and to perform feature alignment and vectorization fusion processing on multi-source data to construct a unified current login feature vector. The multidimensional deviation index calculation module is used to quantify the degree of deviation of login behavior in the scene dimension and behavior dimension. By obtaining parameters such as time range, regional distance, terminal occurrence probability and behavior sequence difference, the scene deviation index and behavior anomaly index are calculated respectively. The comprehensive risk assessment and defense execution module is used to calculate a comprehensive risk score, compare it with the first-level risk threshold and the second-level risk threshold, divide the range, determine the corresponding risk level, and execute differentiated security control strategies, including login permission, enhanced identity verification and blocking and blacklist control, and hierarchical response and dynamic protection for different risk login behaviors.

[0007] Furthermore, the terminal fingerprint identification construction module includes a hardware fingerprint data acquisition unit, a software environment fingerprint data acquisition unit, a network fingerprint data acquisition unit, and a fingerprint fusion and unique identifier generation unit; The hardware fingerprint data acquisition unit is used to collect hardware layer feature information of the terminal in real time through a lightweight Agent deployed on the terminal device, including MAC address, CPU serial number, motherboard serial number and hard disk serial number, and to perform format standardization processing on the collected hardware layer feature information to obtain hardware fingerprint data. The software environment fingerprint data acquisition unit is used to collect software feature information related to the terminal's operating environment, including operating system version, kernel version, list of installed software and system configuration parameters, and to perform standardized encoding and structured processing on the collected software feature information to obtain software environment fingerprint data. The network fingerprint data acquisition unit is used to collect information related to the current network environment of the terminal, including public IP address, private IP address, login area, network operator and network connection method, and to perform normalization processing and area encoding conversion on the network environment information to obtain network fingerprint data; The fingerprint fusion and unique identifier generation unit is used to perform multi-dimensional feature fusion processing on hardware fingerprint data, software environment fingerprint data and network fingerprint data, and generate a unique terminal identifier through a hash mapping algorithm to establish a one-to-one or one-to-many binding relationship between user accounts and terminal identifiers.

[0008] Furthermore, the fingerprint credibility assessment module includes a historical fingerprint data acquisition unit, a fingerprint time series modeling unit, a fingerprint credibility index calculation unit, and a fingerprint credibility analysis unit; The historical fingerprint data acquisition unit is used to extract historical fingerprint data corresponding to the terminal identifier from the terminal trust database and login log database based on the terminal identifier; including hardware fingerprint data, software environment fingerprint data, network fingerprint data and historical login data collected at multiple historical moments. The fingerprint time series modeling unit is used to perform time alignment and feature vectorization processing on multidimensional fingerprint data collected at different times based on the terminal identifier and the corresponding historical fingerprint data, using a time series data modeling method. The multidimensional fingerprint data at each moment is mapped to a fingerprint feature vector to construct a terminal fingerprint time series set. Then, a probabilistic statistical analysis method is used to perform frequency statistics on various fingerprint features in the terminal fingerprint time series set, analyze the probability of occurrence of various fingerprint features in the historical sequence, obtain the fingerprint feature probability distribution, and use a vector difference calculation method to perform difference operations on the fingerprint feature vectors of adjacent moments to obtain the fingerprint change gradient. The fingerprint credibility index calculation unit is used to calculate the probability of occurrence of various fingerprint features based on the fingerprint feature probability distribution, using the information entropy calculation method to weight the probability, analyze the dispersion of terminal fingerprints, and obtain entropy parameters; based on historical fingerprint data, it uses statistical analysis methods to calculate the information entropy of the fingerprint feature probability distribution of each terminal in a stable state, and performs aggregation processing through a weighted average method to obtain standard reference entropy parameters; based on historical fingerprint data, it uses time series difference analysis to calculate the gradient of change between fingerprint feature vectors at adjacent time points, and obtains the upper bound threshold parameter of historical fingerprint changes through the maximum value extraction method, and calculates the fingerprint credibility index after dimensionless processing.

[0009] Furthermore, the fingerprint credibility analysis unit is used to obtain a first evaluation result by comparing the fingerprint credibility index with a preset credibility threshold and performing a comparative analysis, including: When the fingerprint credibility index is greater than or equal to the credibility threshold, the current terminal fingerprint is determined to be in a trusted state, and the current fingerprint feature vector and the corresponding terminal identifier are written into the trusted fingerprint set. When the fingerprint credibility index is less than the credibility threshold, the current terminal fingerprint is determined to be untrusted, indicating that the terminal has the risk of fingerprint forgery or abnormal tampering. The current fingerprint feature vector and terminal identifier are written into the abnormal fingerprint set, and security control policies are executed, including restricting login, recording abnormal logs, and outputting risk indicators.

[0010] Furthermore, the multidimensional login baseline construction module includes a multidimensional baseline construction unit, a baseline dynamic update and optimization unit, and a baseline data output unit; The multidimensional baseline construction unit is used to model the multidimensional features of users’ historical login behavior based on historical login data and trusted fingerprint data in the trusted fingerprint set, and to construct time baseline, regional baseline, terminal baseline and behavior baseline respectively. The baseline dynamic update and optimization unit is used to filter the latest login data within a time range using a sliding time window mechanism based on the time baseline, regional baseline, terminal baseline, and behavioral baseline to obtain valid login data within the current time window. Based on the valid login data, it continuously updates the statistical distribution parameters, frequency parameters, and behavioral feature parameters of the time baseline, regional baseline, terminal baseline, and behavioral baseline using an incremental statistical update method. Furthermore, based on the abnormal fingerprint set, it performs matching, identification, and data removal processing on the corresponding abnormal login data to prevent abnormal samples from participating in the baseline update process and to prevent abnormal data from interfering with the baseline. The baseline data output unit is used to structure and store the dynamically updated and optimized time baseline, regional baseline, terminal baseline, and behavioral baseline.

[0011] Furthermore, the login feature construction module includes a login context data acquisition unit and a login feature vector construction unit; The login context data acquisition unit is used to collect the current terminal's operating status in real time and obtain the current terminal's fingerprint information when it receives a login request initiated by the terminal; at the same time, it collects the current login time and login area, and calls an external reputation evaluation interface based on the public IP address to obtain the IP reputation level; and establishes a login context data set. The login feature vector construction unit is used to perform feature alignment and vectorization encoding on multi-source heterogeneous data based on the login context data set and combined with the fingerprint credibility index. It uniformly maps and fuses the current terminal fingerprint information, login time, login region, IP reputation level, login frequency and request header features to construct the current login feature vector.

[0012] Furthermore, the multidimensional deviation index calculation module includes a scene deviation index calculation unit and a behavior anomaly index calculation unit; The scene deviation index calculation unit is used to obtain and calculate scene deviation-related parameters based on the time baseline, regional baseline, terminal baseline, and current login feature vector. By statistically analyzing historical login time data, the center value of the time baseline is obtained, and the time range parameter is calculated based on the distribution of historical login time data. By statistically analyzing historical login area data, regional baselines are obtained, and the maximum regional distance parameter is calculated based on historical regional data. Based on the terminal baseline, the historical frequency of the current terminal identifier is statistically calculated to obtain the terminal occurrence probability parameter. Using geolocation coding and spatial distance calculation methods, the spatial difference between the current login area and the regional baseline is calculated to obtain the regional distance parameter; After dimensionless processing, a normalized weighted calculation method is used for fusion calculation to obtain the scene deviation index.

[0013] Furthermore, the behavior anomaly index calculation unit is used to acquire and calculate behavior anomaly-related parameters based on the behavior baseline and the current login feature vector; Based on the current login frequency, and by performing sequence extraction and encoding on the actions performed after the current login, the current operation sequence is obtained; Statistical analysis is performed on historical login frequency data to obtain the baseline login frequency, and frequency range parameters are calculated based on the historical frequency distribution. Perform sequence pattern analysis on historical behavior data, and calculate the maximum behavior difference parameter by combining historical behavior difference statistics; The sequence dissimilarity calculation method is used to calculate the difference between the current operation sequence and the behavioral baseline to obtain the sequence dissimilarity parameter; After dimensionless processing, a normalized weighted calculation method is used for fusion calculation to obtain the behavioral anomaly index.

[0014] Furthermore, the comprehensive risk assessment and defense execution module includes a comprehensive risk scoring calculation unit and a risk classification and defense strategy execution unit; The comprehensive risk score calculation unit is used to obtain a comprehensive risk score by processing the acquired fingerprint credibility index, scene deviation index, behavior anomaly index, and IP reputation level without dimensions, and then using a weighted fusion calculation method.

[0015] Furthermore, the risk grading and defense strategy execution unit is used to obtain a second evaluation result by presetting a primary risk threshold and a secondary risk threshold, and comparing the comprehensive risk score with the primary risk threshold and the secondary risk threshold. When the comprehensive risk score is less than or equal to the first-level risk threshold, it is determined to be in a first-level risk state. The basic access policy is executed, allowing the current login request to pass through the authentication process. The login behavior is fully logged, and the current login feature vector is written into the historical login data set for subsequent dynamic updates and optimization of the multi-dimensional login baseline. When the Level 1 risk threshold < comprehensive risk score ≤ Level 2 risk threshold, it is determined to be a Level 2 risk state. An enhanced verification strategy is executed, the current login request is temporarily suspended, and a multi-factor authentication mechanism is triggered to perform secondary verification of the user's identity. Multi-factor authentication includes SMS verification code verification, dynamic token verification, biometric identification or device confirmation verification. After successful authentication, the login request is allowed, and the current login behavior is marked as risk and recorded in the audit log. When the comprehensive risk score exceeds the level 2 risk threshold, it is determined to be a level 3 risk status. The blocking and control policy is implemented, the current login request is rejected, the corresponding terminal identifier and public IP address are written into the dynamic blacklist set to restrict its subsequent access behavior, and a security alarm message is generated and pushed to the security management system. At the same time, abnormal behavior logs are recorded, and security analysis and threat tracing are performed.

[0016] Compared with the prior art, the beneficial effects of the present invention are: This invention achieves dynamic reliability assessment of terminal fingerprints by fusing multi-source information on terminal hardware features, software environment, and network environment, and combining fingerprint credibility index with time series analysis mechanisms. This effectively improves the accuracy of terminal identity recognition and its anti-counterfeiting capabilities. Compared to traditional single fingerprint recognition methods, this invention can identify fingerprint tampering and abnormal changes, reducing the risk of attacks such as counterfeit devices and simulated environments, thus enhancing the security and reliability of the system from the source.

[0017] This invention also achieves refined risk classification control of login behavior by constructing multi-dimensional baselines based on time, region, terminal, and behavior, and combining these with scenario deviation index, behavior anomaly index, and a comprehensive risk scoring mechanism. Through first-level, second-level, and third-level risk classification and the execution of differentiated defense strategies, the system can accurately identify and dynamically protect against abnormal login behavior while ensuring a normal user experience, effectively reducing the false positive rate and improving overall security protection efficiency. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the overall system flow of the present invention. Detailed Implementation

[0019] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0020] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0021] Example 1 Please see Figure 1 This invention provides a technical solution: an AI-powered smart terminal fingerprint verification system based on a multi-dimensional baseline, comprising: The terminal fingerprint identification construction module is used to collect and standardize the hardware feature information, software environment information and network environment information of the terminal device from multiple sources, and generate a unique terminal identifier through multi-dimensional feature fusion and hash mapping to establish the binding relationship between user account and terminal. The fingerprint trustworthiness assessment module is used to calculate the fingerprint trustworthiness index and compare it with the trustworthiness threshold to determine whether the current terminal fingerprint is trustworthy. If it is, the current fingerprint feature vector and the corresponding terminal identifier are written into the trustworthy fingerprint set; if not, the current fingerprint feature vector and the terminal identifier are written into the abnormal fingerprint set, and security control policies are executed. The multidimensional login baseline construction module is used to perform statistical analysis and feature extraction on user login behavior in terms of time, region, terminal and behavior dimensions, construct time baseline, region baseline, terminal baseline and behavior baseline, and dynamically optimize and structure each baseline through sliding time window and incremental update mechanism. The login feature construction module is used to collect login context data such as the current terminal fingerprint information, login time, login region and IP reputation level when receiving a login request, and to perform feature alignment and vectorization fusion processing on multi-source data to construct a unified current login feature vector. The multidimensional deviation index calculation module is used to quantify the degree of deviation of login behavior in the scene dimension and behavior dimension. By obtaining parameters such as time range, regional distance, terminal occurrence probability and behavior sequence difference, the scene deviation index and behavior anomaly index are calculated respectively. The comprehensive risk assessment and defense execution module is used to calculate a comprehensive risk score, compare it with the first-level risk threshold and the second-level risk threshold, divide the range, determine the corresponding risk level, and execute differentiated security control strategies, including login permission, enhanced identity verification and blocking and blacklist control, and hierarchical response and dynamic protection for different risk login behaviors.

[0022] In this embodiment, by integrating terminal fingerprint credibility assessment, multi-dimensional login baseline analysis, and deviation index calculation mechanism, terminal identity features and user behavior features are collaboratively correlated and analyzed. Based on comprehensive risk scoring, hierarchical defense control is achieved, thereby enabling more accurate risk identification and judgment of login behavior. Compared with traditional authentication methods based on single rules or static features, this invention can effectively identify abnormal login and high-risk access behaviors while ensuring fast access for normal users, significantly improving the overall security protection capability and risk response accuracy of the system.

[0023] Example 2 Please see Figure 1 In the explanation of Embodiment 1, the terminal fingerprint identification construction module specifically includes a hardware fingerprint data acquisition unit, a software environment fingerprint data acquisition unit, a network fingerprint data acquisition unit, and a fingerprint fusion and unique identifier generation unit. The hardware fingerprint data acquisition unit is used to collect hardware layer feature information of the terminal in real time through a lightweight Agent deployed on the terminal device, including MAC address, CPU serial number, motherboard serial number and hard disk serial number, and to perform format standardization processing on the collected hardware layer feature information to obtain hardware fingerprint data. The software environment fingerprint data acquisition unit is used to collect software feature information related to the terminal's operating environment, including operating system version, kernel version, list of installed software and system configuration parameters, and to perform standardized encoding and structured processing on the collected software feature information to obtain software environment fingerprint data. The network fingerprint data acquisition unit is used to collect information related to the current network environment of the terminal, including public IP address, private IP address, login area, network operator and network connection method, and to perform normalization processing and area encoding conversion on the network environment information to obtain network fingerprint data; The fingerprint fusion and unique identifier generation unit is used to perform multi-dimensional feature fusion processing on hardware fingerprint data, software environment fingerprint data and network fingerprint data, and generate a unique terminal identifier, denoted as IDt, through a hash mapping algorithm, and establish a one-to-one or one-to-many binding relationship between user accounts and terminal identifiers IDt.

[0024] In this embodiment, by performing multi-source collaborative collection and standardized processing of terminal hardware fingerprints, software environment fingerprints, and network fingerprints, and combining multi-dimensional feature fusion and hash mapping to generate a unique terminal identifier, high-precision unique identification and stable binding of terminal identity are achieved. Compared with single-dimensional fingerprint recognition methods, this can effectively reduce fingerprint conflict and forgery risks, improve the uniqueness and reliability of terminal identity recognition, and provide a reliable data foundation for subsequent security authentication and risk control.

[0025] Example 3 Please see Figure 1 In the explanation of Embodiment 1, the fingerprint credibility assessment module specifically includes a historical fingerprint data acquisition unit, a fingerprint time series modeling unit, a fingerprint credibility index calculation unit, and a fingerprint credibility analysis unit. The historical fingerprint data acquisition unit is used to extract historical fingerprint data corresponding to the terminal identifier IDt from the terminal trust database and login log database based on the terminal identifier IDt; including hardware fingerprint data, software environment fingerprint data, network fingerprint data and historical login data collected at multiple historical moments. The fingerprint time series modeling unit is used to perform time alignment and feature vectorization processing on multidimensional fingerprint data collected at different times based on the terminal identifier IDt and the corresponding historical fingerprint data. The multidimensional fingerprint data at each moment is mapped to a fingerprint feature vector, denoted as fi, to construct a terminal fingerprint time series set. Then, the probability statistical analysis method is used to perform frequency statistics on various fingerprint features in the terminal fingerprint time series set, analyze the probability of occurrence of various fingerprint features in the historical sequence, obtain the fingerprint feature probability distribution, denoted as pj, and use the vector difference calculation method to perform difference operation on the fingerprint feature vectors of adjacent moments to obtain the fingerprint change gradient, denoted as Δfi. The fingerprint confidence index calculation unit is used to calculate the probability of occurrence of various fingerprint features based on the fingerprint feature probability distribution pj, using the information entropy calculation method to weight the probability of occurrence of various fingerprint features, analyze the dispersion of terminal fingerprints, and obtain the entropy parameter, denoted as H; based on historical fingerprint data, it uses statistical analysis methods to calculate the information entropy of the fingerprint feature probability distribution of each terminal in a stable state, and performs aggregation processing through a weighted average method to obtain the standard reference entropy parameter, denoted as Href; based on historical fingerprint data, it uses time series difference analysis to calculate the gradient of change between fingerprint feature vectors at adjacent time points, and obtains the upper bound threshold parameter of historical fingerprint change, denoted as Δfmax, through the maximum value extraction method. After dimensionless processing, it calculates and obtains the fingerprint confidence index, denoted as FTI, as shown in the following formula:

[0026]

[0027] The information entropy represents the impact of fingerprint stability (entropy deviation) on the credibility index and has a high weight. Information entropy reflects the dispersion of multidimensional fingerprint feature distribution. When the entropy value deviates from the reference stable state, it indicates that the overall fingerprint structure has changed abnormally, which is a global feature change. Therefore, it is given a high weight to reflect its dominant role in credibility. The fingerprint change rate (temporal gradient) represents the impact on the credibility index and has a medium weight. The change gradient reflects the fluctuation range of the fingerprint in adjacent time periods. It is mainly used to characterize short-term abnormal changes and is sensitive to sudden tampering. However, its influence range is relatively local, so its weight is slightly lower. By constructing a fingerprint reliability index (FTI) that is a weighted fusion of entropy deviation and change gradient, the consistency of terminal fingerprints in terms of statistical stability and temporal continuity can be comprehensively reflected. A high FTI value indicates that the fingerprint structure is stable and changes smoothly; a low FTI value indicates the presence of abnormal perturbations or forgery risks.

[0028] In this embodiment, by introducing a time-series modeling mechanism for historical fingerprint data and combining multi-dimensional parameters such as fingerprint feature probability distribution, information entropy, and change gradient, a fingerprint credibility index is constructed to achieve a quantitative assessment of the stability and consistency of terminal fingerprints. Compared with traditional static comparison methods, it can effectively identify gradual changes and abnormal fluctuations in fingerprints, improve the detection capabilities for fingerprint forgery, tampering, and environmental simulation behaviors, thereby enhancing the accuracy of terminal identity verification and dynamic security protection capabilities.

[0029] Example 4 Please see Figure 1 In the explanation of Embodiment 3, specifically, the fingerprint credibility analysis unit is used to compare and analyze the fingerprint credibility index FTI with the credibility threshold Fth using a preset credibility threshold, denoted as Fth, to obtain a first evaluation result, including: When the fingerprint credibility index FTI is greater than or equal to the credibility threshold Fth, the current terminal fingerprint is determined to be in a trusted state, and the current fingerprint feature vector and the corresponding terminal identifier are written into the trusted fingerprint set. When the fingerprint trust index FTI < trust threshold Fth, the current terminal fingerprint is determined to be untrusted, indicating that the terminal has a risk of fingerprint forgery or abnormal tampering. The current fingerprint feature vector and terminal identifier are written into the abnormal fingerprint set, and security control policies are executed, including restricting login, recording abnormal logs, and outputting risk indicators.

[0030] How to obtain the credibility threshold Fth: The calibration process of the credibility threshold Fth aims to determine a critical fingerprint credibility index FTI value that can effectively distinguish between "stable and trustworthy terminal fingerprint state" and "abnormal and untrustworthy terminal fingerprint state".

[0031] First, a historical fingerprint data sample library for terminals is constructed. This sample library is obtained through continuous collection of data during the terminal login process in actual business systems, with a sample size of no less than 1,000 sets, covering various states such as normal and stable devices, devices with slight changes in the device environment, and devices that have been abnormally tampered with or forged. Each sample set contains hardware fingerprint data, software environment fingerprint data, network fingerprint data, and corresponding login behavior data collected at multiple times.

[0032] Meanwhile, three or more engineers with experience in information security and endpoint security analysis, combined with device usage records, abnormal behavior detection results and security audit logs, will label each group of samples with the "gold standard" and classify them into "fingerprint trusted state" or "fingerprint untrusted state" (including device forgery, abnormal environmental changes and fingerprint drift anomalies, etc.).

[0033] Subsequently, the Fingerprint Trust Index (FTI) was uniformly calculated for the sample data, and a statistical distribution analysis was performed on the FTI values ​​for the two states, plotting probability density function curves. Generally, the FTI values ​​corresponding to trusted fingerprint states are generally higher, while the FTI values ​​corresponding to untrusted states are generally lower, with some overlap between the two in certain local intervals.

[0034] Based on this, the classification effect is evaluated by constructing an ROC curve, and the point with the largest Youden index is selected as the optimal split point, thereby achieving a balance between recognition accuracy and false positive rate.

[0035] Based on comprehensive statistical analysis and engineering experience, a reliability threshold Fth of 0.70 is selected as the optimal value. When Fth ≥ 0.70, the fingerprint is considered reliable; when Fth < 0.70, the fingerprint is considered unreliable, and corresponding security control strategies are triggered.

[0036] In this embodiment, by setting a confidence threshold and combining it with the fingerprint confidence index, the system can automatically classify and manage the fingerprint status of the terminal, effectively distinguishing between normal and abnormal fingerprints and including them in the trusted fingerprint set and the abnormal fingerprint set, respectively. This enables timely identification of potential fingerprint forgery and tampering behaviors, and triggers security control strategies for restriction and alarm processing, improving the system's response speed and risk handling capabilities for abnormal terminals, while enhancing the security and controllability of the overall identity authentication process.

[0037] Example 5 Please see Figure 1 In the explanation of Embodiment 1, the multidimensional login baseline construction module specifically includes a multidimensional baseline construction unit, a baseline dynamic update and optimization unit, and a baseline data output unit. The multidimensional baseline construction unit is used to model the user's historical login behavior in multiple dimensions based on historical login data and trusted fingerprint data in the trusted fingerprint set, using statistical analysis methods. It constructs a time baseline, denoted as Tbase, a regional baseline, denoted as Lbase, a terminal baseline, denoted as Dbase, and a behavior baseline, denoted as Bbase. Perform time distribution statistical analysis on historical login time data, calculate login frequency in different time periods, obtain the frequently used login time intervals of users, and construct a time baseline Tbase; Spatial distribution statistics are performed on historical login geographic location data, and probability calculations are performed on login switching paths between different regions to obtain login area distribution characteristics and area switching probability characteristics, and to construct a regional baseline Lbase; The usage frequency of the bound terminal identifier IDt is statistically analyzed, the usage ratio and activity of each terminal are calculated, the terminal usage habit characteristics are obtained, and the terminal baseline Dbase is constructed. Sequence features are extracted from historical login behavior data, login frequency and time interval between adjacent logins are calculated, and pattern recognition and feature encoding are performed on the operation sequence after login to obtain user behavior pattern features and construct behavior baseline Bbase; The baseline dynamic update and optimization unit is used to filter the latest login data within a time range based on the time baseline Tbase, regional baseline Lbase, terminal baseline Dbase, and behavioral baseline Bbase using a sliding time window mechanism to obtain valid login data within the current time window. Based on the valid login data, it continuously updates the statistical distribution parameters, frequency parameters, and behavioral feature parameters in the time baseline Tbase, regional baseline Lbase, terminal baseline Dbase, and behavioral baseline Bbase using an incremental statistical update method. Furthermore, based on the abnormal fingerprint set, it performs matching, identification, and data removal processing on the corresponding abnormal login data to prevent abnormal samples from participating in the baseline update process and to prevent abnormal data from interfering with the baseline. The baseline data output unit is used to structure and store the dynamically updated and optimized time baseline Tbase, regional baseline Lbase, terminal baseline Dbase, and behavioral baseline Bbase.

[0038] In this embodiment, a baseline is constructed for user login behavior across multiple dimensions, including time, region, terminal, and behavior. By combining a sliding time window and an incremental update mechanism, dynamic adaptive optimization of the baseline is achieved. At the same time, data corresponding to abnormal fingerprints is removed to avoid interference with the baseline. This enables the system to continuously and accurately characterize the features of normal user login behavior, improve the accuracy and stability of abnormal behavior identification, reduce the false judgment rate, and enhance the system's long-term security protection capabilities in complex scenarios.

[0039] Example 6 Please see Figure 1 In the explanation of Embodiment 1, the login feature construction module specifically includes a login context data acquisition unit and a login feature vector construction unit. The login context data acquisition unit is used to collect the current terminal running status in real time when a login request is received from the terminal, obtain the current terminal fingerprint information, denoted as fcur; at the same time, it collects the current login time, denoted as tcur and the login area, denoted as lcur, and obtains the IP reputation level, denoted as Rip, by calling an external reputation assessment interface based on the public IP address; and establishes a login context data set. The login feature vector construction unit is used to perform feature alignment and vectorization encoding on multi-source heterogeneous data based on the login context data set and combined with the fingerprint credibility index (FTI). It performs unified mapping and fusion of the current terminal fingerprint information (fcur), login time (tcur), login region (lcur), IP reputation level (Rip), login frequency (freqcur), and request header features to construct the current login feature vector, denoted as Xcur.

[0040] Example 7 Please see Figure 1 In the explanation of Embodiment Six, the multidimensional deviation index calculation module specifically includes a scene deviation index calculation unit and a behavior anomaly index calculation unit. The scene deviation index calculation unit is used to obtain and calculate scene deviation-related parameters based on the time baseline Tbase, the regional baseline Lbase, the terminal baseline Dbase, and the current login feature vector Xcur. By statistically analyzing historical login time data, the center value of the time baseline is obtained, denoted as Tbase, and the time range parameter is calculated based on the distribution of historical login time data, denoted as Trange. By statistically analyzing historical login area data, the regional baseline is obtained, denoted as Lbase, and the maximum regional distance parameter is calculated based on the historical regional data, denoted as Lmax. Based on the terminal baseline Dbase, the historical frequency of occurrence of the current terminal identifier IDt is statistically calculated to obtain the terminal occurrence probability parameter, denoted as Pdevice; Using geolocation coding and spatial distance calculation methods, the spatial difference between the currently logged-in area (lcur) and the regional baseline (Lbase) is calculated to obtain the regional distance parameter, denoted as . ; After dimensionless processing, a normalized weighted calculation method is used for fusion calculation to obtain the Scene Deviation Index, denoted as SDI, as shown in the following formula:

[0041] In the formula, w1, w2 and w3 represent weighting coefficients.

[0042] The degree of time offset represents the impact of scene deviation and has a medium weight; the deviation of login time from user habits can reflect abnormal behavior, but time has a certain degree of flexibility, so the weight is moderate. The influence of spatial location offset (regional distance) on scene deviation is characterized by a high weight; abrupt changes in geographical location (such as across regions or countries) usually have a strong indicative significance of anomalies, and are therefore given a high weight. The probability of terminal usage has a moderate weighting on the impact of scenario deviation; low-frequency or new device logins serve as a risk warning, but there may be reasonable additions of new devices, so their weighting is comparable to that of the time factor. By weighting and fusing time offset, spatial distance, and terminal usage probability, a Scenario Deviation Index (SDI) is constructed, which can characterize the degree of abnormality in login behavior at the usage environment level. A higher SDI indicates a more significant deviation from the normal login scenario.

[0043] In this embodiment, by combining time baseline, regional baseline and terminal baseline, the login behavior is quantitatively analyzed in terms of multiple dimensions such as time offset, spatial location difference and terminal usage probability, and a scenario deviation index is constructed to achieve a fine characterization of the degree of abnormality of the login scenario. Compared with the traditional single-condition judgment method, it can more accurately identify risky behaviors such as cross-regional abnormal login, login at unusual times and abnormal device use, thereby improving the sensitivity and accuracy of abnormal scenario identification.

[0044] Example 8 Please see Figure 1 In the explanation of Embodiment Seven, the behavior anomaly index calculation unit is used to acquire and calculate behavior anomaly-related parameters based on the behavior baseline Bbase and the current login feature vector Xcur. Based on the current login frequency freqcur, and by performing sequence extraction and encoding on the operation behavior after the current login, the current operation sequence is obtained and denoted as seqcur; Perform statistical analysis on historical login frequency data to obtain the baseline login frequency, denoted as freqbase, and calculate the frequency range parameter based on the historical frequency distribution, denoted as freqrange; Sequence pattern analysis is performed on historical behavioral data, and the maximum behavioral difference parameter, denoted as Bmax, is calculated by combining the statistical analysis of historical behavioral differences. The sequence dissimilarity calculation method is used to calculate the difference between the current operation sequence seqcur and the behavioral baseline Bbase, and the sequence dissimilarity parameter is obtained, denoted as . ; After dimensionless processing, a normalized weighted calculation method is used for fusion calculation to obtain the behavioral anomaly index, denoted as BAI, as shown in the following formula:

[0045] In the formula, s1 and s2 represent weighting coefficients.

[0046] The degree of deviation in login frequency represents the impact on abnormal behavior and has a high weight; abnormal frequency (such as sudden high frequency or sudden login after a long period of inactivity) is usually an important feature of attack behavior and is therefore given a high weight. The impact of differences in operational behavior sequences on behavioral anomalies is given higher weight; operational sequences directly reflect user behavior patterns, and their differences can accurately identify abnormal operations or automated attack behaviors, so they are given the highest weight as the core discrimination criterion. By fusing login frequency offset and behavioral sequence differences, a behavioral anomaly index (BAI) is constructed, which reflects the degree of deviation in user behavior. When the BAI increases, it indicates that the behavioral pattern is significantly abnormal.

[0047] In this embodiment, by modeling the user login frequency and operation behavior sequence, and combining the behavior baseline to calculate the difference of the current behavior, a behavior anomaly index is constructed to achieve a quantitative assessment of the degree of deviation of the user's operation mode. This can effectively identify abnormal operation sequences and abnormal frequency changes. Compared with the traditional static rule detection method, it improves the ability to identify covert attack behaviors and abnormal usage patterns, and enhances the system's security protection effect at the behavior level.

[0048] Example 9 Please see Figure 1 In the explanation of Embodiment 8, the comprehensive risk assessment and defense execution module specifically includes a comprehensive risk scoring calculation unit and a risk classification and defense strategy execution unit. The comprehensive risk score calculation unit is used to obtain a comprehensive risk score, denoted as RSI, by processing the acquired fingerprint credibility index (FTI), scene deviation index (SDI), behavior anomaly index (BAI), and IP reputation level (RIP) without dimensions, and then using a weighted fusion calculation method. The formula is as follows:

[0049] In the formula, d1, d2, d3 and d4 represent weighting coefficients.

[0050] The fingerprint credibility factor represents the impact of overall risk and has a medium to high weight. Terminal identity credibility is a basic security element, but it cannot determine the risk level on its own, so it is given an important but not the highest weight. The degree of deviation from the target scenario has a medium weighting on the impact of risk; abnormal login scenarios can reflect environmental risks, but need to be judged in combination with behavior and fingerprints. The degree of abnormal behavior represents the impact on risk and has a medium to high weight; abnormal behavior is usually the most direct manifestation of an attack, so its weight is comparable to the reliability of the fingerprint. This represents the impact of IP reputation rating on risk and has a relatively low weight; IP reputation is external auxiliary information and has a certain degree of uncertainty, hence its low weight. By integrating terminal fingerprint trustworthiness, login scenario deviation, abnormal user behavior, and IP reputation level, a comprehensive risk score (RSI) is constructed to achieve a unified quantitative expression of multi-dimensional risk factors. An increase in the RSI value indicates an increase in the overall risk level of login behavior, providing a basis for risk classification and defense strategies.

[0051] In this embodiment, a unified comprehensive risk scoring model is constructed by integrating multiple risk factors such as fingerprint credibility index, scene deviation index, behavior anomaly index, and IP reputation level, to achieve a comprehensive quantitative assessment of login behavior risk. Compared with a single indicator judgment method, it can more comprehensively reflect the true risk level of login behavior, improve the accuracy and stability of risk identification, and provide a reliable basis for the precise execution of subsequent hierarchical defense strategies.

[0052] Example 10 Please see Figure 1 In the explanation of Example 9, specifically, the risk grading and defense strategy execution unit is used to preset a primary risk threshold, denoted as Rth1, and a secondary risk threshold, denoted as Rth2, and to compare and analyze the comprehensive risk score RSI with the primary risk threshold Rth1 and the secondary risk threshold Rth2 to obtain a second evaluation result, including: When the comprehensive risk score RSI is less than or equal to the first-level risk threshold Rth1, it is determined to be a first-level risk state. The basic access policy is executed, allowing the current login request to pass through the authentication process. The login behavior is fully logged, and the current login feature vector is written into the historical login data set for subsequent dynamic updates and optimization of the multi-dimensional login baseline. When the Level 1 risk threshold Rth1 < Comprehensive Risk Score RSI ≤ Level 2 risk threshold Rth2, the system is classified as Level 2 risk. An enhanced verification strategy is implemented, which temporarily suspends the current login request and triggers a multi-factor authentication mechanism to perform secondary verification of the user's identity. Multi-factor authentication includes SMS verification code verification, dynamic token verification, biometric identification, or device confirmation verification. After successful authentication, the login request is allowed, and the current login behavior is marked as risk and recorded in the audit log. When the comprehensive risk score RSI is greater than the secondary risk threshold Rth2, it is judged as a level 3 risk state. The blocking and control policy is implemented, the current login request is rejected, the corresponding terminal identifier IDt and public IP address are written into the dynamic blacklist set to restrict its subsequent access behavior, and a security alarm message is generated and pushed to the security management system. At the same time, abnormal behavior logs are recorded, and security analysis and threat tracing are performed.

[0053] The method for obtaining the primary risk threshold Rth1 and the secondary risk threshold Rth2: The calibration process of the primary risk threshold Rth1 and the secondary risk threshold Rth2 aims to classify the risk of login behavior, thereby distinguishing the comprehensive risk score RSI intervals corresponding to low risk, medium risk and high risk status.

[0054] First, a login risk assessment sample database was constructed. This database is based on actual business system operation data, with a sample size of no less than 1,000 sets, covering various scenarios such as normal login, suspicious login, and attack behavior. Each sample set includes parameters such as Fingerprint Trust Index (FTI), Scenario Deviation Index (SDI), Behavior Anomaly Index (BAI), and IP Reputation Rating (Rip), and the corresponding comprehensive risk score (RSI) is calculated.

[0055] Meanwhile, three or more experts with network security analysis experience, combined with security logs, attack detection results and user behavior analysis, will label each group of samples with the "gold standard" and classify them into "Level 1 risk status", "Level 2 risk status" and "Level 3 risk status".

[0056] Subsequently, a statistical distribution analysis was performed on the comprehensive risk scores (RSI) corresponding to different risk categories, and probability density distribution curves were plotted. Generally, the RSI value of Level 1 risk status is relatively low, the RSI value of Level 3 risk status is relatively high, and Level 2 risk status is in the middle range with some overlap between adjacent ranges.

[0057] Based on this, binary ROC curves for "Level 1-Level 2 Risk" and "Level 2-Level 3 Risk" are constructed respectively, and the point with the largest Youden index in each category is selected as the optimal split point to determine two key thresholds.

[0058] Based on comprehensive statistical results and actual security strategy requirements, the optimal risk threshold Rth1 is 0.30, and the risk threshold Rth2 is 0.70. A risk level of RSI ≤ 0.30 is classified as Level 1; a risk level of 0.30 < RSI ≤ 0.70 is classified as Level 2; and a risk level of RSI > 0.70 is classified as Level 3. This ensures the effective implementation of risk-level control and differentiated defense strategies.

[0059] In this embodiment, by setting first-level and second-level risk thresholds and dividing the comprehensive risk score into intervals, the system can achieve hierarchical judgment of login behavior and execution of differentiated defense strategies. This enables the system to take measures such as allowing access, enhanced verification, and blocking control according to the degree of risk. Thus, while ensuring convenient access for normal users, the system can effectively intercept and handle medium- and high-risk behaviors, thereby improving the overall level of security protection and response efficiency.

[0060] It should be noted that all calculation formulas in this application employ regression analysis, including but not limited to machine learning algorithms, to deeply analyze the collected parameters and identify their natural trends and interrelationships. Specialized software, such as Python's Scikit-learn library or the R language, is used to automatically generate mathematical models that match the data. Then, cross-validation and other methods are used to objectively evaluate the model performance, and continuous feedback and optimization are combined to ensure that the created formulas truly reflect the inherent laws of the data, thereby guaranteeing their effectiveness and accuracy. In all calculation formulas in this application, the parameters in each formula undergo dimensionless processing within a consistent range to ensure that different physical quantities are compared on the same scale; dimensionless processing techniques include, but are not limited to, min-max-normalization and Z-score standardization. The algorithm of this invention is implemented as a Python script. Before executing the core logic, the program first executes a data loading module (e.g., using the widely used pandas library in Python) configured to read the aforementioned spreadsheet file and load its contents into the program's working memory (e.g., a DataFrame data structure). Subsequent algorithm steps will directly query and retrieve the required configuration parameters from this in-memory data structure.

[0061] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. An AI-powered smart terminal fingerprint verification system based on multi-dimensional baselines, characterized in that: include: The terminal fingerprint identification construction module is used to collect and standardize the hardware feature information, software environment information and network environment information of the terminal device from multiple sources, and generate a unique terminal identifier through multi-dimensional feature fusion and hash mapping to establish the binding relationship between user account and terminal. The fingerprint trustworthiness assessment module is used to calculate the fingerprint trustworthiness index and compare it with the trustworthiness threshold to determine whether the current terminal fingerprint is trustworthy. If it is, the current fingerprint feature vector and the corresponding terminal identifier are written into the trustworthy fingerprint set; if not, the current fingerprint feature vector and the terminal identifier are written into the abnormal fingerprint set, and security control policies are executed. The multidimensional login baseline construction module is used to perform statistical analysis and feature extraction on user login behavior in terms of time, region, terminal and behavior dimensions, construct time baseline, region baseline, terminal baseline and behavior baseline, and dynamically optimize and structure each baseline through sliding time window and incremental update mechanism. The login feature construction module is used to collect login context data such as the current terminal fingerprint information, login time, login region and IP reputation level when receiving a login request, and to perform feature alignment and vectorization fusion processing on multi-source data to construct a unified current login feature vector. The multidimensional deviation index calculation module is used to quantify the degree of deviation of login behavior in the scene dimension and behavior dimension. By obtaining parameters such as time range, regional distance, terminal occurrence probability and behavior sequence difference, the scene deviation index and behavior anomaly index are calculated respectively. The comprehensive risk assessment and defense execution module is used to calculate a comprehensive risk score, compare it with the first-level risk threshold and the second-level risk threshold, divide the range, determine the corresponding risk level, and execute differentiated security control strategies, including login permission, enhanced identity verification and blocking and blacklist control, and hierarchical response and dynamic protection for different risk login behaviors.

2. The AI ​​smart terminal fingerprint verification system based on multi-dimensional baselines according to claim 1, characterized in that: The terminal fingerprint identification construction module includes a hardware fingerprint data acquisition unit, a software environment fingerprint data acquisition unit, a network fingerprint data acquisition unit, and a fingerprint fusion and unique identifier generation unit. The hardware fingerprint data acquisition unit is used to collect hardware layer feature information of the terminal in real time through a lightweight Agent deployed on the terminal device, including MAC address, CPU serial number, motherboard serial number and hard disk serial number, and to perform format standardization processing on the collected hardware layer feature information to obtain hardware fingerprint data. The software environment fingerprint data acquisition unit is used to collect software feature information related to the terminal's operating environment, including operating system version, kernel version, list of installed software and system configuration parameters, and to perform standardized encoding and structured processing on the collected software feature information to obtain software environment fingerprint data. The network fingerprint data acquisition unit is used to collect information related to the current network environment of the terminal, including public IP address, private IP address, login area, network operator and network connection method, and to perform normalization processing and area encoding conversion on the network environment information to obtain network fingerprint data; The fingerprint fusion and unique identifier generation unit is used to perform multi-dimensional feature fusion processing on hardware fingerprint data, software environment fingerprint data and network fingerprint data, and generate a unique terminal identifier through a hash mapping algorithm to establish a one-to-one or one-to-many binding relationship between user accounts and terminal identifiers.

3. The AI ​​smart terminal fingerprint verification system based on multi-dimensional baselines according to claim 1, characterized in that: The fingerprint credibility assessment module includes a historical fingerprint data acquisition unit, a fingerprint time series modeling unit, a fingerprint credibility index calculation unit, and a fingerprint credibility analysis unit. The historical fingerprint data acquisition unit is used to extract historical fingerprint data corresponding to the terminal identifier from the terminal trust database and login log database based on the terminal identifier. This includes hardware fingerprint data, software environment fingerprint data, network fingerprint data, and historical login data collected at multiple historical moments. The fingerprint time series modeling unit is used to perform time alignment and feature vectorization processing on multidimensional fingerprint data collected at different times based on the terminal identifier and the corresponding historical fingerprint data, using a time series data modeling method. The multidimensional fingerprint data at each moment is mapped to a fingerprint feature vector to construct a terminal fingerprint time series set. Then, a probabilistic statistical analysis method is used to perform frequency statistics on various fingerprint features in the terminal fingerprint time series set, analyze the probability of occurrence of various fingerprint features in the historical sequence, obtain the fingerprint feature probability distribution, denoted as pj, and use a vector difference calculation method to perform difference operation on the fingerprint feature vectors of adjacent moments to obtain the fingerprint change gradient, denoted as Δfi. The fingerprint confidence index calculation unit is used to calculate the probability of occurrence of various fingerprint features based on the fingerprint feature probability distribution pj, using the information entropy calculation method to weight the probability of occurrence of various fingerprint features, analyze the dispersion of terminal fingerprints, and obtain the entropy parameter, denoted as H; based on historical fingerprint data, it uses statistical analysis methods to calculate the information entropy of the fingerprint feature probability distribution of each terminal in a stable state, and performs aggregation processing through a weighted average method to obtain the standard reference entropy parameter, denoted as Href; based on historical fingerprint data, it uses time series difference analysis to calculate the gradient of change between fingerprint feature vectors at adjacent time points, and obtains the upper bound threshold parameter of historical fingerprint change, denoted as Δfmax, through the maximum value extraction method. After dimensionless processing, it calculates and obtains the fingerprint confidence index, denoted as FTI, as shown in the following formula: In the formula, a1 and a2 represent weighting coefficients.

4. The AI ​​smart terminal fingerprint verification system based on a multi-dimensional baseline according to claim 3, characterized in that: The fingerprint credibility analysis unit is used to obtain a first evaluation result by comparing the fingerprint credibility index with a preset credibility threshold and performing a comparative analysis. When the fingerprint credibility index is greater than or equal to the credibility threshold, the current terminal fingerprint is determined to be in a trusted state, and the current fingerprint feature vector and the corresponding terminal identifier are written into the trusted fingerprint set. When the fingerprint credibility index is less than the credibility threshold, the current terminal fingerprint is determined to be untrusted, indicating that the terminal has the risk of fingerprint forgery or abnormal tampering. The current fingerprint feature vector and terminal identifier are written into the abnormal fingerprint set, and security control policies are executed, including restricting login, recording abnormal logs, and outputting risk indicators.

5. The AI ​​smart terminal fingerprint verification system based on multi-dimensional baselines according to claim 1, characterized in that: The multidimensional login baseline construction module includes a multidimensional baseline construction unit, a baseline dynamic update and optimization unit, and a baseline data output unit; The multidimensional baseline construction unit is used to model the multidimensional features of users’ historical login behavior based on historical login data and trusted fingerprint data in the trusted fingerprint set, and to construct time baseline, regional baseline, terminal baseline and behavior baseline respectively. The baseline dynamic update and optimization unit is used to filter the latest login data within a time range using a sliding time window mechanism based on the time baseline, regional baseline, terminal baseline, and behavioral baseline to obtain valid login data within the current time window. Based on the valid login data, it continuously updates the statistical distribution parameters, frequency parameters, and behavioral feature parameters of the time baseline, regional baseline, terminal baseline, and behavioral baseline using an incremental statistical update method. Furthermore, based on the abnormal fingerprint set, it performs matching, identification, and data removal processing on the corresponding abnormal login data to prevent abnormal samples from participating in the baseline update process and to prevent abnormal data from interfering with the baseline. The baseline data output unit is used to structure and store the dynamically updated and optimized time baseline, regional baseline, terminal baseline, and behavioral baseline.

6. The AI ​​smart terminal fingerprint verification system based on multi-dimensional baselines according to claim 1, characterized in that: The login context data acquisition unit is used to collect the current terminal running status in real time when a login request is received from the terminal, obtain the current terminal fingerprint information, denoted as fcur; at the same time, it collects the current login time, denoted as tcur and the login area, denoted as lcur, and obtains the IP reputation level, denoted as Rip, by calling an external reputation assessment interface based on the public IP address; and establishes a login context data set. The login feature vector construction unit is used to perform feature alignment and vectorization encoding on multi-source heterogeneous data based on the login context data set and combined with the fingerprint credibility index (FTI). It performs unified mapping and fusion of the current terminal fingerprint information (fcur), login time (tcur), login region (lcur), IP reputation level (Rip), login frequency (freqcur), and request header features to construct the current login feature vector, denoted as Xcur.

7. The AI ​​smart terminal fingerprint verification system based on multi-dimensional baselines according to claim 6, characterized in that: The multidimensional deviation index calculation module includes a scene deviation index calculation unit and a behavior anomaly index calculation unit; The scene deviation index calculation unit is used to obtain and calculate scene deviation-related parameters based on the time baseline Tbase, the regional baseline Lbase, the terminal baseline Dbase, and the current login feature vector Xcur. By statistically analyzing historical login time data, the center value of the time baseline is obtained, denoted as Tbase, and the time range parameter is calculated based on the distribution of historical login time data, denoted as Trange. By statistically analyzing historical login area data, the regional baseline is obtained, denoted as Lbase, and the maximum regional distance parameter is calculated based on the historical regional data, denoted as Lmax. Based on the terminal baseline Dbase, the historical frequency of occurrence of the current terminal identifier IDt is statistically calculated to obtain the terminal occurrence probability parameter, denoted as Pdevice; Using geolocation coding and spatial distance calculation methods, the spatial difference between the currently logged-in area (lcur) and the regional baseline (Lbase) is calculated to obtain the regional distance parameter, denoted as . ; After dimensionless processing, a normalized weighted calculation method is used for fusion calculation to obtain the Scene Deviation Index, denoted as SDI, as shown in the following formula: In the formula, w1, w2 and w3 represent weighting coefficients.

8. The AI ​​smart terminal fingerprint verification system based on a multi-dimensional baseline according to claim 7, characterized in that: The behavior anomaly index calculation unit is used to acquire and calculate behavior anomaly-related parameters based on the behavior baseline and the current login feature vector. Based on the current login frequency freqcur, and by performing sequence extraction and encoding on the operation behavior after the current login, the current operation sequence is obtained and denoted as seqcur; Perform statistical analysis on historical login frequency data to obtain the baseline login frequency, denoted as freqbase, and calculate the frequency range parameter based on the historical frequency distribution, denoted as freqrange; Sequence pattern analysis is performed on historical behavioral data, and the maximum behavioral difference parameter, denoted as Bmax, is calculated by combining the statistical analysis of historical behavioral differences. The sequence dissimilarity calculation method is used to calculate the difference between the current operation sequence seqcur and the behavioral baseline Bbase, and the sequence dissimilarity parameter is obtained, denoted as . ; After dimensionless processing, a normalized weighted calculation method is used for fusion calculation to obtain the behavioral anomaly index, denoted as BAI, as shown in the following formula: In the formula, s1 and s2 represent weighting coefficients.

9. The AI ​​smart terminal fingerprint verification system based on a multi-dimensional baseline according to claim 8, characterized in that: The comprehensive risk assessment and defense execution module includes a comprehensive risk scoring calculation unit and a risk classification and defense strategy execution unit; The comprehensive risk score calculation unit is used to obtain a comprehensive risk score by processing the acquired fingerprint credibility index, scene deviation index, behavior anomaly index, and IP reputation level without dimensions, and then using a weighted fusion calculation method.

10. The AI ​​smart terminal fingerprint verification system based on a multi-dimensional baseline according to claim 9, characterized in that: The risk grading and defense strategy execution unit is used to obtain a second evaluation result by presetting a primary risk threshold and a secondary risk threshold, and comparing the comprehensive risk score with the primary and secondary risk thresholds. When the comprehensive risk score is less than or equal to the first-level risk threshold, it is determined to be in a first-level risk state. The basic access policy is executed, allowing the current login request to pass through the authentication process. The login behavior is fully logged, and the current login feature vector is written into the historical login data set for subsequent dynamic updates and optimization of the multi-dimensional login baseline. When the Level 1 risk threshold < comprehensive risk score ≤ Level 2 risk threshold, it is determined to be a Level 2 risk state. An enhanced verification strategy is executed, the current login request is temporarily suspended, and a multi-factor authentication mechanism is triggered to perform secondary verification of the user's identity. Multi-factor authentication includes SMS verification code verification, dynamic token verification, biometric identification or device confirmation verification. After successful authentication, the login request is allowed, and the current login behavior is marked as risk and recorded in the audit log. When the comprehensive risk score exceeds the level 2 risk threshold, it is determined to be a level 3 risk status. The blocking and control policy is implemented, the current login request is rejected, the corresponding terminal identifier and public IP address are written into the dynamic blacklist set to restrict its subsequent access behavior, and a security alarm message is generated and pushed to the security management system. At the same time, abnormal behavior logs are recorded, and security analysis and threat tracing are performed.

Images