A webassembly-based non-conscious human verification method

Abstract

The application discloses a kind of based on WebAssembly's no-sense man-machine verification method, it is related to man-machine verification technical field, wherein method includes: acquisition user multidimensional data, constructs dynamic risk model based on time attenuation algorithm;Synchronous to the verification code is processed with multiple layers of confusion, encrypting algorithm is compiled as WebAssembly module deployment front end;Response to the request initiated by user, and risk score is calculated in combination with equipment, IP data, and verification or graded verification code check is executed according to grade;After completing graphic verification, front end calls Wasm module encryption to generate ciphertext upload server, server compares ciphertext, consistent then release, inconsistent intercept business and return exception data update risk model, form complete risk control closed loop.The application realizes differentiated no-sense verification by dynamic risk grading check, solves the problem that unified verification mode experience is poor and false interception is high.

Description

Technical Field

[0001] This invention relates to the field of human-machine verification technology, and in particular to a non-contact human-machine verification method and device based on WebAssembly. Background Technology

[0002] Against the backdrop of rapid development in the digital economy, the scale of online services such as e-commerce transactions and online business processing continues to expand. This has led to frequent cyberattacks, including automated scripts for bulk access, automated order manipulation, and malicious cracking, posing significant technical challenges to online human-machine risk control verification systems. Current mainstream online graphic CAPTCHA protection solutions mostly rely on basic graphic processing methods such as simple graphic distortion and adding interference lines to obfuscate the CAPTCHA, resulting in weak overall image anti-recognition capabilities. With the continuous iteration and maturation of OCR optical recognition technology and artificial intelligence image analysis technology, traditionally simple graphic CAPTCHAs are easily and accurately recognized and brute-forced by intelligent algorithms, failing to effectively resist large-scale, intelligent machine-based bulk attacks, highlighting significant vulnerabilities in risk control protection.

[0003] Currently, most human-machine verification front-end validation logic is developed using JavaScript. This technology has inherent security flaws and performance shortcomings. JavaScript code is displayed in plaintext on the front end, making it extremely vulnerable to reverse engineering, code tampering, and replay attacks by malicious actors, resulting in poor security and confidentiality of the verification logic. Furthermore, script execution efficiency is low, easily leading to excessively high verification latency and insufficient operational stability in high-concurrency, high-traffic business scenarios, making it difficult to adapt to the high-frequency online business risk control requirements.

[0004] Furthermore, existing verification systems lack sophisticated user risk identification mechanisms and dynamically adaptable verification strategies. Verification strength is often fixed, failing to differentiate risk levels based on multi-dimensional user behavior data, transaction data, and abnormal operation data. This model lacks intelligent risk assessment capabilities, triggering unnecessary verification operations for low-risk, normal users, resulting in cumbersome verification processes, poor user experience, and high false positive rates. Insufficient verification strength also prevents effective interception of high-risk malicious users, making it difficult to achieve a balance between security protection and user experience. Moreover, the lack of a complete risk data closed-loop optimization mechanism hinders continuous improvement in risk control identification accuracy.

[0005] In summary, existing image CAPTCHA protection technologies generally suffer from many technical drawbacks, such as weak resistance to machine recognition and cracking, insufficient front-end verification security and performance, rigid risk control strategies, imbalance between security and user experience, and lack of a closed-loop optimization system. There is an urgent need for a WebAssembly-based seamless human-machine verification method that is highly secure, high-performance, hierarchical, and has closed-loop iteration capabilities. Summary of the Invention

[0006] The main objective of this invention is to provide a non-contact human-computer verification method based on WebAssembly.

[0007] Another objective of this invention is to propose a non-contact human-machine verification device based on WebAssembly.

[0008] The third objective of this invention is to provide an electronic device.

[0009] A fourth objective of this invention is to provide a non-transitory computer-readable storage medium.

[0010] To achieve the above objectives, a first aspect of the present invention proposes a non-contact human-computer verification method based on WebAssembly, comprising: Collect multi-dimensional behavioral data, transaction data, abnormal operation data and user identification information of users, and dynamically calculate based on time decay algorithm to generate multi-dimensional risk user model; The system acquires a graphical verification code image and performs multiple graphical obfuscation processes to generate an obfuscated verification code image that is resistant to machine recognition. At the same time, the encryption algorithm module is compiled into WebAssembly binary format and loaded into the front end. Respond to users' real-time requests, collect the current user's device fingerprint, request IP, and user identification information, and calculate a real-time risk score by weighting it with a multi-dimensional risk user model. Match the corresponding risk level according to the risk score and execute the corresponding verification strategy, triggering the front end to display an obfuscated CAPTCHA image or pass the verification without verification, thus completing the graded verification. After the user completes the graphical verification based on the obfuscated CAPTCHA image displayed on the front end, the WebAssembly binary format encryption algorithm module is called to perform cryptographic calculations on the graphical verification result and generate verification ciphertext. The verification ciphertext and the graphical verification result are then submitted to the server together. The server-side graph verification result is compared with the standard ciphertext generated locally using the same algorithm. If they match, the user is allowed to pass; otherwise, the current business process is blocked, and the abnormal behavior record is fed back to the multi-dimensional risk user model for iterative updates, thus completing the risk handling closed loop.

[0011] Optionally, multi-dimensional behavioral data, transaction data, abnormal operation data, and user identification information of users are collected, and a multi-dimensional risk user model is generated based on a time decay algorithm, including: Obtain the user's user ID, mobile phone number, access IP, device ID, and ID card number as user identification information; Collect user location data, click data, browsing data, search data, and shopping cart addition data as behavioral data; Obtain user order and payment data as transaction data; Obtain brute-force attack records and risk control interception records as abnormal operation data; Using multi-dimensional data as input, dynamic weighted calculations are performed based on a time decay algorithm to generate the multi-dimensional risk user model.

[0012] Optionally, the image of the CAPTCHA is acquired and subjected to multiple image obfuscation processes to generate a machine-resistant obfuscated CAPTCHA image, including: Apply random perturbation to the RGB three-channel pixel values ​​of the graphic verification code image; The perturbed image is subjected to weighted grayscale conversion, and the weights are assigned according to the human eye’s sensitivity to the red, green and blue channels. Noise, speckles and short line interference elements are randomly added to the grayscale converted image. Two gap regions are randomly selected in the image and their positions are swapped. The color difference between the text color and the background color in the image is adjusted to a range that is discernible to the human eye but difficult for a machine to separate, so that the text and the background form a visual fusion, and the anti-machine recognition obfuscation verification code image is output.

[0013] Optionally, the encryption algorithm module can be compiled into WebAssembly binary format and loaded into the front end, including: The logic code for the encryption algorithm is written in C language, and the logic code is compiled into an encryption module in WebAssembly binary format; The encryption module in the WebAssembly binary format is loaded into the front-end browser environment via JavaScript. The encryption algorithm module is used to perform cryptographic calculations on the graphics verification results on the front end, and the encryption round number and encryption key are compiled into binary data in the WebAssembly binary format.

[0014] Optionally, the risk score is used to match the corresponding risk level and the corresponding verification strategy is executed, including: When the real-time risk score is lower than the first preset threshold, it is determined to be a low-risk level, and the verification-free pass strategy is implemented, and the front end does not display the obfuscated verification code image; When the real-time risk score is between the first preset threshold and the second preset threshold, it is determined to be of medium risk level, and the basic strength verification strategy is executed, and the front end displays the obfuscated verification code image of basic strength. When the real-time risk score is higher than the second preset threshold, it is determined to be a high-risk level, and an enhanced verification strategy is executed. The front end displays the enhanced obfuscated CAPTCHA image, wherein the verification strength is positively correlated with the real-time risk score.

[0015] Optionally, the record of this abnormal behavior can be fed back to the multi-dimensional risk user model for iterative updates, including: In response to inconsistent results from server-side comparison, the current user's business operation process is interrupted. The user identification information, device fingerprint, request IP, and operation time associated with this abnormal behavior will be recorded as risk behavior data. Risk behavior data is input into the multi-dimensional risk user model as new samples. The risk weight parameters of users in each dimension are recalculated based on the time decay algorithm, the multi-dimensional risk user model is updated, and the closed-loop iterative optimization of the risk model is completed.

[0016] To achieve the above objectives, a second aspect of the present invention provides a WebAssembly-based contactless human-machine verification device, comprising: The risk modeling unit is used to collect multi-dimensional behavioral data, transaction data, abnormal operation data and user identification information of users, and dynamically calculates and generates multi-dimensional risk user models based on the time decay algorithm. The verification building unit is used to acquire the image verification code and perform multiple image obfuscation processes to generate an obfuscated verification code image that is resistant to machine recognition. At the same time, it compiles the encryption algorithm module into WebAssembly binary format and loads it into the front end. The hierarchical verification unit is used to respond to users' real-time requests, collect the current user's device fingerprint, request IP and user identification information, and calculate the real-time risk score by weighting it with the multi-dimensional risk user model. Based on the risk score, it matches the corresponding risk level and executes the corresponding verification strategy, triggering the front end to display an obfuscated CAPTCHA image or pass the verification without verification, thus completing the hierarchical verification. The encrypted submission unit is used to call the WebAssembly binary format encryption algorithm module after the user completes the graphics verification based on the obfuscated verification code image displayed on the front end, to perform cryptographic calculations on the graphics verification result and generate verification ciphertext, and submit the verification ciphertext and the graphics verification result together to the server. The result processing unit is used to compare the graphics verification result received by the server with the standard ciphertext generated locally using the same algorithm. If the comparison matches, the user is allowed to pass; otherwise, the current business process is blocked, and the abnormal behavior record is fed back to the multi-dimensional risk user model for iterative updates, thus completing the risk processing closed loop.

[0017] Regarding the apparatus in the above embodiments, the specific manner in which each unit performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0018] To achieve the above objectives, a third aspect of this application provides an electronic device, including a processor and a memory; wherein the processor runs a program corresponding to the executable program code stored in the memory, in order to implement a WebAssembly-based contactless human-machine verification method as described in the first aspect embodiment.

[0019] To achieve the above objectives, a fourth aspect of this application provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements a WebAssembly-based contactless human-computer verification method as described in the first aspect embodiment.

[0020] The embodiments of the present invention have the following beneficial effects: 1. Significantly enhances the anti-crack capability of CAPTCHAs. This application adopts a multi-layered graphic obfuscation processing mechanism, which effectively destroys machine image recognition features and inhibits automated OCR recognition cracking behavior through multiple layers of protection such as pixel perturbation, grayscale weighting, interference addition, gap replacement, and text-background fusion. This significantly enhances the anti-attack capability of CAPTCHAs and effectively resists malicious behaviors such as machine-generated bulk orders.

[0021] 2. Enhance front-end verification security and computational performance. This application employs WebAssembly binary encryption to replace the traditional JavaScript plaintext verification method, effectively preventing reverse engineering and replay attacks on the front-end logic, enabling encrypted transmission and comparison, and improving verification security. Simultaneously, it significantly reduces encryption computation time, adapts to high-concurrency business scenarios, and improves the overall system response efficiency and stability.

[0022] 3. Achieve seamless risk-based verification, balancing security and user experience. This application constructs a dynamic risk model based on multi-dimensional user data, enabling quantitative scoring of user risk and differentiated verification strategies. Low-risk users are exempt from verification, while verification intensity is progressively increased for medium- and high-risk users. This effectively reduces verification time and false blocking rate for normal users, optimizing the user experience while ensuring risk control accuracy.

[0023] 4. Possesses closed-loop iteration capabilities, ensuring strong system risk control stability. This application can feed abnormal behavior data back to the risk model in real time, enabling dynamic iterative optimization of the model and continuously improving the accuracy of risk identification. It can stably support hundreds of millions of calls and high-concurrency scenarios such as major promotions and limited-time sales, effectively suppressing malicious order-brushing behavior and ensuring the fair and stable operation of online business. Attached Figure Description

[0024] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1A flowchart illustrating a contactless human-computer verification method based on WebAssembly, provided as an embodiment of the present invention; Figure 2 This is a flowchart illustrating the entire process of hierarchical, contactless CAPTCHA risk control provided in this embodiment of the invention. Figure 3 A flowchart of the preprocessing of multi-graphic obfuscation CAPTCHA provided in this embodiment of the invention; Figure 4 This is a flowchart of the WebAssembly front-end SM4 encryption comparison interaction provided in an embodiment of the present invention; Figure 5 A flowchart illustrating the multi-dimensional risk model-driven hierarchical verification strategy provided in this embodiment of the invention; Figure 6 This is a structural diagram of a WebAssembly-based contactless human-machine verification device provided in an embodiment of the present invention. Detailed Implementation

[0025] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0026] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0027] The following description, with reference to the accompanying drawings, describes a WebAssembly-based contactless human-machine verification method and apparatus according to an embodiment of the present invention.

[0028] Example 1 This invention provides a contactless human-computer verification method based on WebAssembly. Figure 1 This is a flowchart illustrating a contactless human-computer verification method based on WebAssembly provided in an embodiment of the present invention. Figure 1 As shown, the method includes the following steps: Step S1: Collect multi-dimensional behavioral data, transaction data, abnormal operation data, and user identification information of users, and dynamically calculate based on the time decay algorithm to generate a multi-dimensional risk user model.

[0029] In this embodiment, this step is the foundational modeling stage of the entire risk control verification scheme, serving as the core data and logical prerequisite for the subsequent implementation of real-time risk scoring and tiered verification strategies. In actual execution, the first step is to accurately collect and organize the user's raw data across all dimensions. The collected raw data covers four core categories, comprehensively encompassing user identity, behavior, transactions, and abnormal operations, with no data dimensions omitted.

[0030] The first category is user identification information, specifically including five core identification data types: user ID, mobile phone number, access IP, device ID, and national ID card number. Simultaneously, based on a pre-defined device fingerprint generation mechanism, it automatically captures hardware and software environment information such as the user terminal's browser identifier, browser version, and operating system. By integrating the aforementioned device characteristic information, it generates a unique user device identifier. This unique identifier enables precise binding and independent identification of the user device, effectively distinguishing user requests from different login devices and terminals, and mitigating fundamental risks such as device forgery and multi-device fraud.

[0031] The second category is user behavior data, which records the entire interaction trajectory of users on the business platform. Specifically, it covers daily interaction behavior data such as user access location information, page click operations, product browsing trajectory, keyword search behavior, and shopping cart addition operations. It fully restores the normal user habits and operation characteristics, and provides behavioral data support for distinguishing normal user behavior from abnormal machine behavior.

[0032] The third category is user transaction data, which comes from the historical business data of users retained by the platform. It mainly includes users' historical order records, platform payment transaction information, and purchase records of various products, especially popular products. It can accurately reflect users' transaction habits, consumption frequency, and purchase behavior characteristics, and is the core transaction dimension data for determining the risk level of user transactions.

[0033] The fourth category is abnormal operation data, which specifically collects users' records of illegal and risky operations. This includes records of account brute-force attacks, historical risk control interception records of the platform, and various illegal operation behaviors such as automated scripts for order brushing. It accurately retains the abnormal and risky behavior characteristics of users and provides direct abnormal data basis for the identification of high-risk users.

[0034] After completing the comprehensive collection and normalization of the aforementioned multi-dimensional raw data, the system uses all valid data as unified input parameters for the algorithm, and connects to a preset time decay algorithm to perform dynamic weighted calculation. In this embodiment, the time decay algorithm has precise quantization calculation logic, and its fixed calculation formula is:

[0035] in, The final quantitative risk score for the user at the current time t is the comprehensive risk score output by the time decay algorithm in this application. The time interval between the generation time of a single valid data point and the current algorithm operation node is uniformly measured in days. This refers to the basic risk score corresponding to a single piece of collected data. Different types and scenarios of operational data correspond to preset basic scores. This represents the total number of compliant and valid data entries under the current username to be tested.

[0036] The core computational logic of this algorithm features dynamic weight adaptation. Instead of uniformly assigning weights to all historical data, it follows weight allocation rules that align with actual risk control scenarios. It assigns higher computational weights to various behavioral data, transaction data, and abnormal operation data generated by users recently, which can accurately reflect the user's current actual operational risk status. As for historical data generated by users in the distant past, its data weight will gradually decrease over time, avoiding interference from outdated historical data in the current user risk assessment, and effectively improving the real-time performance and accuracy of risk assessment.

[0037] Through dynamic quantification calculations using this time decay algorithm, the system ultimately generates a multi-dimensional risk user model that can be updated in real time and dynamically iterated. This model integrates full-dimensional features of user identity, device, behavior, transactions, and abnormal operations to comprehensively depict the dynamic risk profile of each user, accurately quantify the differences in risk levels among different users, and provide solid and comprehensive data support and model foundation for subsequent real-time risk score calculations for user requests and the execution of differentiated grading verification strategies.

[0038] Step S2: Obtain the image of the graphic verification code and perform multiple graphic obfuscation processes to generate an obfuscated verification code image that is resistant to machine recognition. At the same time, compile the encryption algorithm module into WebAssembly binary format and load it into the front end.

[0039] This step involves the parallel completion of two core processes: secure processing of CAPTCHA images and deployment of the front-end encryption module. These two processes are completed simultaneously and work together to address the technical shortcomings of traditional CAPTCHAs, which are easily recognized by OCR and front-end verifications, which are easily tampered with and cracked, from the two dimensions of preventing CAPTCHA image recognition and preventing verification data from being cracked.

[0040] In the image obfuscation process, a compliant base image is first selected as the CAPTCHA background image. Then, multiple progressive image obfuscation processes are executed sequentially to comprehensively disrupt machine recognition features while preserving normal human visual recognition capabilities. First, RGB pixel perturbation processing is performed. The RGB three-channel pixel values ​​of the CAPTCHA image are randomly increased or decreased within a preset range of ±8 to ±16, completely breaking the fixed pixel value patterns relied upon by machine recognition without affecting the overall recognition effect of the CAPTCHA image content by the human eye. Subsequently, weighted grayscale processing is performed, based on the differences in human visual sensitivity to the three primary colors of red, green, and blue. The standard weighting formula completes the grayscale conversion, effectively weakening the image contour boundaries that can be captured by machine recognition, and further reducing the success rate of machine contour extraction.

[0041] After grayscale processing, interference elements are added to randomly populate the CAPTCHA image with colored or black-and-white spots, short lines, or blurred color blocks. This further obscures the text and outline features of the CAPTCHA, increasing the difficulty for machine recognition. Next, two independent gap regions within the image are randomly selected and their positions swapped, disrupting the automated script's logic for CAPTCHA gap location while still allowing the human eye to clearly distinguish the correct gap match. Finally, text-background fusion optimization is performed, adjusting the color difference ΔE between the CAPTCHA text and the background color. This color difference is strictly controlled within the range of 8-12, achieving a high degree of visual fusion between the text and background. This results in an image that is clearly recognizable by the human eye but cannot be accurately identified by machine color segmentation systems. The final product is a highly obfuscated CAPTCHA image with strong OCR resistance, compatible with various mainstream styles such as single slider, double slider, image restoration, image rotation, and text selection.

[0042] In the WebAssembly encryption verification process, this application's embodiment abandons the shortcomings of traditional JavaScript verification schemes and adopts a high-performance, high-security WebAssembly encryption mechanism. First, complete algorithm logic code integrating multi-round substitution encryption and SM4 symmetric encryption is written in C language. The multi-round substitution encryption uses a 62-bit character mapping table to implement multiple rounds of cyclic character substitution. The domestic SM4 symmetric encryption algorithm uses a 128-bit block length and a 128-bit key length, and includes a built-in dedicated key extension parameter FK, a fixed parameter CK, and 32 rounds of iterative operation logic. After completing the code, the complete encryption algorithm code is compiled into a WebAssembly binary module that can be directly executed by the browser. Simultaneously, core parameters such as the number of encryption rounds and the core encryption key are all embedded within the binary file, completely avoiding the risks of plaintext leakage on the front end and reverse engineering of the algorithm.

[0043] Subsequently, the compiled WebAssembly binary module is loaded in the front-end browser environment via JavaScript. Relying on WebAssembly's execution efficiency, which is ten times that of JavaScript, the encryption calculation time in high-concurrency scenarios is controlled within 30ms. This ensures the response speed of the front-end verification and realizes the transmission of verification data in encrypted form throughout the process, eliminating security risks such as plaintext transmission, data tampering, and replay attacks.

[0044] Step S3: Respond to the user's real-time request, collect the current user's device fingerprint, request IP and user identification information, and calculate the real-time risk score by weighting it with the multi-dimensional risk user model. Match the corresponding risk level according to the risk score and execute the corresponding verification strategy, triggering the front end to display the obfuscated CAPTCHA image or pass the verification without verification, thus completing the graded verification.

[0045] This step is the core execution step for achieving differentiated, seamless verification. When a user initiates various real-time business requests to the platform, such as purchasing, placing an order, making a payment, or logging in, the real-time data collection and risk assessment mechanism is immediately triggered.

[0046] The core feature data corresponding to this request is captured in real time, including the unique device fingerprint generated by the current user device, the real-time access IP address, and the user's unique identification information. The above real-time dynamic data is weighted and fused with the multi-dimensional risk user model built in step S1 to generate a standardized real-time user risk score between 0 and 100. The higher the score, the higher the risk of the user's operation.

[0047] This application implements a three-tiered differentiated verification strategy based on risk score values. Verification strength is positively correlated with the risk score, and the system supports expanding to more tiers based on actual business needs, adapting to the risk control requirements of different business scenarios. When a user's real-time risk score is less than 30, it is classified as low-risk, and the system executes a seamless verification-free strategy; the front end does not need to display any obfuscated CAPTCHA image, and the user can directly complete the business operation. When a user's real-time risk score is greater than or equal to 30 but less than 80, it is classified as medium-risk, and a basic-strength obfuscated CAPTCHA is enabled, pushing a basic-sized verification image to the front end for the user to complete the verification. When a user's real-time risk score is greater than or equal to 80, it is classified as high-risk, and an enhanced-strength obfuscated CAPTCHA is enabled, pushing a CAPTCHA image that has undergone comprehensive high-strength obfuscation processing, strictly controlling the operation permissions of high-risk users, and achieving tiered risk control.

[0048] Step S4: After the user completes the graphical verification based on the obfuscated verification code image displayed on the front end, the WebAssembly binary format encryption algorithm module is called to perform cryptographic calculations on the graphical verification result and generate verification ciphertext. The verification ciphertext and the graphical verification result are then submitted to the server together.

[0049] This step is a crucial transitional procedure following the completion of the tiered verification process and connecting to server-side verification. It's important to note that this step has a clear trigger threshold; only users assessed as medium or high risk by S3 will complete the entire process. Low-risk users with a score below 30 do not need to load the CAPTCHA image and can skip the graphical interaction and front-end encryption steps in this step. The system will directly allow the corresponding business requests, thus ensuring a smooth user experience for low-risk users.

[0050] When a user is determined to be at a medium or high risk level, the front-end page loads and displays an obfuscated CAPTCHA image generated through S2 multi-image obfuscation. The user needs to complete the corresponding verification operation through human-computer interaction. Optional operation types include various mainstream verification methods such as slider dragging, image rotation, text selection, and image restoration. After the user completes all manual interaction actions, the front-end page captures and accurately retains the user's complete verification operation trajectory in real time, simultaneously extracting the original result data corresponding to this graphics verification, fully preserving the user's interactive behavior characteristics, and providing original input materials for subsequent cryptographic encryption operations.

[0051] After collecting the complete original results of the graphics verification, the front-end program actively calls the WebAssembly binary encryption algorithm module, which was pre-loaded and resides in the browser's runtime environment in step S2. Based on this binary module, it performs complex cryptographic calculations on the original verification results submitted by the user. The entire encryption operation integrates two layers of encryption logic, sequentially executing multiple rounds of substitution encryption and the domestic SM4 symmetric encryption operation. After the two layers of algorithms are superimposed, a unique and irreversible verification ciphertext is generated. A single interaction result will only correspond to one unique ciphertext, and there will be no duplicate matching.

[0052] The entire encryption operation is completed within the WebAssembly binary isolation environment of the front-end browser. No plaintext data related to graphical verification is transmitted during the operation, thus avoiding the security risks of the original verification data being captured by network packet sniffing tools or tampered with by malicious scripts, significantly improving the security of front-end interactive data transmission. After the front-end completes all encryption calculations and generates the verification ciphertext, the program simultaneously encapsulates two types of core data: the original graphical verification result generated by the user's operation and the verification ciphertext obtained through composite encryption operations. These two types of data are integrated into a unified data packet and sent to the back-end server, awaiting the server to retrieve the corresponding encryption logic to complete the ciphertext comparison and verification.

[0053] Step S5: Compare the graph verification result received by the server with the standard ciphertext generated locally using the same algorithm. If they match, allow the user to pass; otherwise, block the current business process and record the abnormal behavior to the multi-dimensional risk user model for iterative updates, thus completing the risk handling loop.

[0054] Based on the execution logic of this step, the entire risk control system can achieve closed-loop management of verification, risk handling, and continuous model optimization, connecting the entire link from user request to model self-update.

[0055] After receiving the complete verification data packet pushed by the frontend, the backend server first parses and splits the data packet to extract the original graphical verification result submitted by the user. Then, the server retrieves the encryption algorithm, the matching encryption key, and the preset number of encryption rounds that are completely matched with the frontend WebAssembly module. Based on the extracted original verification data, it independently performs encryption operations and autonomously generates a standard comparison ciphertext for benchmark comparison. After the ciphertext is generated, the locally generated standard ciphertext and the verification ciphertext uploaded by the frontend are compared and verified character by character to determine the authenticity of the user's verification behavior.

[0056] When the two sets of encrypted messages are found to be completely identical after comparison, the current user's verification operation is confirmed to be legitimate and valid. The business interception restriction is directly lifted, and the business request initiated by the current user is allowed to proceed. The user can continue to perform subsequent business operations such as placing orders, making payments, and purchasing goods without any hindrance, and the entire verification process is terminated simultaneously.

[0057] If the comparison results of the two sets of encrypted data show discrepancies, the submission operation is immediately identified as an abnormal and risky operation. Such operations are mostly initiated by automated machine scripts, batch order-brushing programs, or illegal account hacking programs. This will immediately block all pending business processes for the user and refuse to execute any subsequent business operations, thus intercepting risky behavior at the business level. During this process, all complete data associated with this abnormal operation is automatically collected, including user-specific identification information, a unique device identifier generated from a device fingerprint, the real-time request IP address corresponding to this access, the precise timestamp of the abnormal operation, and other core risk control data. This integrated and complete information is stored as a new risk behavior sample in the platform's dedicated risk database for archiving.

[0058] While archiving risk behavior records, the newly added abnormal risk sample data is fed back into the multi-dimensional risk user model built in step S1. A unified time decay algorithm is used to recalculate the risk weight parameters corresponding to each data dimension of the user, dynamically refreshing the user's unique dynamic risk profile. Global parameters within the multi-dimensional risk user model are updated synchronously, and the model is iteratively optimized in real time using continuously added real abnormal samples, gradually improving the model's accuracy in identifying various risk behaviors. Based on the handling logic of this step, the entire solution ultimately forms a complete and controllable risk control closed loop. The links are, in sequence: multi-dimensional data collection and modeling, real-time user risk assessment and grading, differentiated CAPTCHA verification, front-end encrypted transmission, server-side encrypted comparison, abnormal behavior recording, and risk model iterative updates. The entire process is interconnected and continuously self-optimizing.

[0059] To fully verify the feasibility, stability, and actual risk control effect of this application, this application conducted large-scale implementation and application experiments based on real online high-concurrency business scenarios. Through multiple rounds of full-process online operation of actual business activities, complete measured operation parameters, risk control effect data, and system stability data were obtained, effectively proving that the technical solution of this application can be stably implemented and reused at scale, and has significant technical advantages and business benefits compared with traditional CAPTCHA risk control solutions.

[0060] All experimental verification work of the technical solution in this application was carried out on the China Post Online Business Platform. The actual test verification was completed based on the real business environment of the platform with high concurrency, high purchase volume, and high risk of fraudulent orders. It covered high-pressure business scenarios such as the issuance of national commemorative stamps and e-commerce promotions. Specific verification scenarios included typical high-concurrency purchase scenarios such as large-scale marketing activities of China Post Online Business Hall and the centralized issuance of commemorative stamps on major themes. The test environment was realistic, the business traffic was sufficient, and the risk samples were rich. The verification results have strong authenticity and representativeness.

[0061] The specific scenario experimental verification steps of this application fully conform to the aforementioned overall technical process from S1 to S5, and complete the full-link test verification by combining real business requests. The specific implementation process is as follows: The first step is risk model pre-construction. Before the official business activities begin, comprehensive historical data of existing users on the platform is collected in advance. This includes user historical order data, platform payment transaction records, records of previous stamp purchases, historical abnormal operation interception records, device fingerprint unique identification data, and other multi-dimensional information. Based on the time decay algorithm preset in this application, dynamic weighted calculations are completed. Combining the weight decay characteristics of data from different periods, the risk characteristics of each user are accurately quantified. The construction and initialization of multi-dimensional risk user models are completed in advance, providing stable model support for real-time risk scoring during the activities.

[0062] The second step is the pre-generation of CAPTCHA samples. To ensure response speed and verification stability in high-concurrency scenarios, two types of mainstream obfuscated CAPTCHAs adapted to flash sale scenarios are pre-generated in batches: single-slider CAPTCHAs and image rotation CAPTCHAs. All pre-generated CAPTCHAs have undergone the aforementioned multi-image obfuscation processing technology, possessing excellent anti-OCR recognition capabilities. They can be flexibly invoked according to the user's risk level, meeting the differentiated verification needs of low, medium, and high risk levels.

[0063] The third step involves real-time user requests and risk score calculation. During peak business periods such as stamp sales and promotional events, when users enter the product details page and initiate business requests such as purchasing or placing orders, a multi-dimensional data collection mechanism is triggered in real time. This mechanism simultaneously captures real-time behavioral data such as the user's unique device fingerprint, real-time access IP address, page dwell time, mouse clicks, and page browsing. The real-time collected data is then dynamically weighted and calculated against a pre-built multi-dimensional risk user model to quickly output a real-time risk score for the user between 0 and 100, enabling immediate risk assessment for each business request.

[0064] The fourth step is the implementation of the tiered verification strategy. Based on the user's real-time risk score, the system automatically matches the corresponding risk level and triggers three types of verification strategies: seamless verification, basic verification, and enhanced verification. In this application's testing process, three typical user samples were selected for comparative verification. First, high-quality existing users, with a tested risk score of 22 (below 30, low risk), directly implemented the seamless verification strategy, allowing them to smoothly complete the order process without any verification code operation, providing a seamless user experience. Second, newly registered users, with a tested risk score of 45 (between 30 and 80, medium risk), were activated using the basic verification mechanism, requiring them to complete a single-slider graphic verification code before proceeding to the order process. Third, high-risk users marked as abnormal, with a tested risk score of 86 (above 80, high risk), were activated using the enhanced verification mechanism, pushing a highly obfuscated image rotation verification code to intercept machine scripts and illegal order-placing behavior through more difficult human-machine verification.

[0065] The fifth step is the processing of verification results and the closed-loop iteration of the model. For each user's verification code result, differentiated business processing logic is executed. If the user successfully completes the corresponding level of graphical verification and the encrypted text comparison between the front-end and server matches, the verification is deemed valid, allowing the user to complete all subsequent business operations such as order placement and payment. If the user fails verification, the encrypted text comparison is inconsistent, or abnormal operation behavior occurs, the system immediately blocks the current purchase and related business processes. Simultaneously, it automatically collects complete risk data corresponding to this abnormal operation, including user identifier, device fingerprint, request IP, and operation time, and records it in the user risk behavior database. This data is then fed back to the multi-dimensional risk user model as a new iterative sample. Combined with a time decay algorithm, the user risk score and model weight parameters are updated in real time to continuously optimize the model's recognition accuracy, achieving a two-way closed loop between experimental verification and model iteration.

[0066] After multiple rounds of large-scale deployment and verification in major online business scenarios, the technical solution proposed in this application has accumulated a large amount of stable and reusable real-world operational data, fully demonstrating the practicality, stability, and risk control effectiveness of the solution. The core real-world operational indicators are as follows: The technical solution proposed in this application can handle an average of approximately 720 million API calls per year, which can fully adapt to the platform's ultra-high traffic concurrency scenarios; the end-to-end verification time in core business scenarios is stably controlled within 100ms, with fast response speed and excellent user experience; relying on hierarchical verification and multiple anti-fraud mechanisms, the proportion of machine-generated orders for popular products has been significantly reduced to below 1%, with significant risk control interception effects; the entire system has been running stably without failure for a long time, with no lag, downtime, or surge in false blocking issues under high concurrency scenarios; at the same time, the platform supports dynamically adjusting the proportion of users exempt from verification according to business scenarios and user volume, which can flexibly adapt to the risk control requirements of different activities, and has extremely strong scenario adaptability.

[0067] Example 2 This invention also relates to a WebAssembly-based contactless human-machine verification system. The overall technical process is divided into six core stages, each stage being interconnected and iteratively linked. This achieves end-to-end intelligent risk control and management, from data collection and modeling, CAPTCHA preprocessing, real-time risk assessment, differentiated hierarchical verification, encrypted comparison and verification to model iterative optimization. The overall process architecture corresponds to... Figure 2 The overall technical flow diagram is shown below.

[0068] Phase 1: Multi-dimensional Data Processing. The system continuously collects and organizes user basic and behavioral data across all dimensions, covering four categories of information: identity and device identification, business interaction behavior, order payment transactions, and violations / abnormal operations. Utilizing a time decay algorithm, dynamic weighted calculations are performed to ultimately construct a multi-dimensional risk user model that can be iteratively updated in real time, providing core model support for subsequent real-time risk scoring. The data collection dimensions in this application comprehensively cover four core data categories: The first category is basic user identification data, including unique identifiers such as user ID, mobile phone number, access IP, device number, and ID card number; the second category is user space and behavioral trajectory data, including daily interaction behavior data such as user access location, page clicks, product browsing, keyword searches, and shopping cart additions; the third category is user transaction data, covering transaction flow information such as user historical order records and platform payment records; and the fourth category is user abnormal operation data, including various violation operation data such as account brute-force attacks and historical risk control interception records.

[0069] Phase Two: Image CAPTCHA Pre-processing. The system selects a standard background image suitable for the business scenario and combines it with the proprietary multi-image obfuscation technology and WebAssembly front-end encryption technology to pre-process various CAPTCHAs, ensuring the output speed and security strength of CAPTCHAs under high-concurrency scenarios. This application is compatible with various mainstream human-computer verification styles, including single-slider verification, double-slider verification with deceptive image cutout, image restoration verification, image rotation verification, and text selection verification, which can be flexibly adapted and called according to different business scenarios and user risk levels.

[0070] Phase 3: Real-time Risk Assessment. When a user initiates real-time business requests to the platform, such as browsing, purchasing, placing orders, or making payments, the system simultaneously captures real-time dimensional information such as the user's device fingerprint, real-time request IP, and bound mobile phone number. The system then performs weighted fusion calculations with the real-time feature data and a pre-built multi-dimensional risk user model to generate a standardized user risk score between 0 and 100 in real time, quantifying the risk level of the user's request.

[0071] Phase Four: Tiered Verification. The system categorizes users into differentiated risk levels based on their real-time risk scores and matches corresponding verification strategies. This allows for dynamic adaptive adjustment of risk control intensity, with verification intensity positively correlated with the user's risk score. Furthermore, the system can be expanded to include more tiers based on actual business operational needs, adapting to business scenarios with varying levels of risk control stringency. Specific tiering rules are as follows: Tier 1: Low-risk users, with a risk score less than 30. The system implements a seamless verification-free strategy, allowing users to pass verification directly without any CAPTCHA operation. Tier 2: Medium-risk users, with a risk score greater than or equal to 30 and less than 80. The system uses basic-strength CAPTCHAs for human-machine verification. Tier 3: High-risk users, with a risk score greater than or equal to 80. The system uses enhanced-strength CAPTCHAs for high-intensity human-machine verification, accurately blocking various types of automated order manipulation and unauthorized access.

[0072] Phase 5: Encrypted Comparison. After the user completes the graphical human-computer verification operation displayed on the front end, the front end simultaneously collects the graphical verification result and performs WebAssembly cryptographic encryption operations. The original graphical verification result and the encrypted ciphertext data are then submitted to the backend server, where the server performs standardized ciphertext comparison and verification to avoid the security risks associated with plaintext transmission.

[0073] Phase Six: Result Handling and Model Iteration. After the server completes the encrypted comparison, it executes differentiated business processing. If the comparison results match, the user's verification is deemed legitimate, and the user is allowed to continue performing subsequent business operations. If the comparison results do not match, it is determined to be an abnormal risk operation, and all business processes of the current user are immediately blocked. At the same time, the system automatically retains the relevant data of this abnormal operation and adds it to the user risk behavior database. This data is then fed back as new samples to the multi-dimensional risk user model, driving continuous iteration and optimization of the model, further improving the accuracy of risk identification, and forming a closed loop of risk control throughout the entire process.

[0074] To address the industry shortcomings of traditional CAPTCHA images, such as their single image features, regular contours, and susceptibility to mass cracking by OCR machine recognition tools, this application innovatively proposes a multi-layered progressive image obfuscation processing technology. Through multi-dimensional and multi-level image modification, it completely breaks down machine recognition features while preserving normal human visual recognition capabilities, effectively improving the CAPTCHA's resistance to machine recognition. The specific processing flow is as follows: Figure 3 The flowchart for graphic obfuscation processing shown below outlines the specific implementation steps.

[0075] Step 1: RGB Pixel Perturbation (A new innovation in this application). This step randomly perturbs the original RGB three-channel pixel values ​​of the CAPTCHA image, completely disrupting the fixed pixel value patterns that machine recognition relies on. In the specific implementation, the system traverses all pixels in the image and randomly increases or decreases the R, G, and B channel values ​​corresponding to each pixel. The preferred perturbation range is set to ±8 to ±16. This perturbation range can disrupt the machine's pixel recognition patterns while ensuring that the overall visual effect of the image is not significantly distorted and will not interfere with the human eye recognition experience of normal users, achieving the basic optimization effect of being difficult for machines to recognize but easy for the human eye to identify.

[0076] Step 2: Weighted Grayscale Processing (A New Innovation in This Application). To further weaken the image contour boundaries that machines can capture while ensuring clarity for human visual recognition, this application uses differentiated weighting ratios to complete image grayscale conversion based on the differences in human visual sensitivity to the three primary colors of red, green, and blue. This application preferably uses the standard weighted grayscale formula Gray=0.299R+0.587G+0.114B for calculation, accurately matching the characteristics of human visual perception, effectively weakening image edge contour features, significantly reducing the recognition success rate of machine contour extraction algorithms, and further widening the gap between machine recognition and human visual recognition capabilities.

[0077] Step 3: Add interference elements. Based on the grayscale processed CAPTCHA image, the system randomly inserts colored or black-and-white spots, short lines, blurred color blocks, and other random interference elements at different locations in the image. This further blurs the effective outlines of the CAPTCHA text and slider cutout, fills blank areas in the image, increases the difficulty for the machine to recognize effective characters and effective gap positions, and interferes with the machine's accurate extraction and positioning of the target outline.

[0078] Step 4: Gap Position Swapping (A New Innovation in This Application). Addressing the vulnerability of slider-type CAPTCHAs where machines can accurately locate the gap coordinates, this application innovatively adds gap position swapping logic. The system randomly selects two independent cutout gap areas within the CAPTCHA image and swaps the pixel positions of the two gaps. This completely disrupts the fixed positioning logic of the automated script for the gap positions, making it difficult for machines to identify the correct gap positions through coordinate matching. However, the human eye can still quickly distinguish the effective matching positions through visual comparison, significantly improving the anti-cracking capability of slider CAPTCHAs.

[0079] Step 5: Text-Background Fusion (A New Innovation in This Application). To address the issue of high accuracy in machine color segmentation and recognition, this application precisely controls the color difference between the CAPTCHA text and the background, strictly limiting the color difference value ΔE between the text and background to within the range of 8 to 12, resulting in a high degree of fusion between the text and background colors. This design achieves seamless visual separation between the text and background, allowing ordinary users to clearly distinguish the text content with their naked eyes, while machine color segmentation and recognition systems cannot accurately differentiate between foreground text and background areas, effectively preventing attacks that rely on color threshold segmentation for automatic recognition. For example, a light blue background can be used, paired with a darker shade of the same blue for the text, achieving a visual fusion effect. After the above five layers of multi-layer obfuscation processing, the final output CAPTCHA image possesses strong anti-OCR recognition capabilities, effectively resisting various automated recognition attacks.

[0080] Traditional front-end JavaScript verification schemes suffer from numerous drawbacks, including low code execution efficiency, poor security of plaintext transmission, vulnerability to reverse engineering and tampering of source code, and susceptibility to replay attacks. To address these technical pain points, this application introduces a novel WebAssembly encrypted verification mechanism, achieving a dual upgrade in both front-end computing performance and data transmission security. The specific technical process is as follows: Figure 4 The flowchart shown is for the WebAssembly encryption verification technology.

[0081] I. Technical Principles. WebAssembly (WASM) is a high-efficiency binary execution format that can compile functional code written in high-performance compiled languages ​​such as C, C++, and Rust into binary modules that can be directly recognized and run by browsers. It breaks through the performance bottleneck of traditional JavaScript script interpretation and execution, and the overall code execution speed is more than ten times faster than traditional JavaScript. It can efficiently carry out complex cryptographic encryption operations and adapt to the verification computing power requirements of high-concurrency business scenarios.

[0082] II. Specific Implementation Process. The complete implementation process of the WebAssembly encryption verification mechanism in this application consists of six steps, with front-end and back-end collaboration to complete encryption and comparison verification. Step 1: Encryption Module Development. The complete logic code for a multi-round substitution encryption and SM4 symmetric encryption composite algorithm is written in C language to ensure the rigor and efficiency of the encryption algorithm. Step 2: Binary Compilation. The completed encryption source code is compiled into a WebAssembly binary module, realizing the binary solidification of the algorithm logic. Step 3: Front-end Environment Loading. The compiled binary module is loaded into the front-end browser runtime environment using JavaScript, completing module initialization and residency. Step 4: Front-end Cryptographic Calculation. After the user completes the graphical verification operation, the front-end calls the residency WASM module to perform encryption calculations on the verification result, generating a unique verification ciphertext. Step 5: Server-side Standard Ciphertext Generation and Comparison. The server generates standard ciphertext using completely consistent encryption algorithms, keys, and round numbers, and performs a precise comparison with the ciphertext uploaded by the front-end. Step 6: Verification Result Determination. Based on the ciphertext comparison result, the verification is determined to be successful or unsuccessful, and the final verification result is output.

[0083] III. Encryption Algorithm System. This application adopts a two-layer composite encryption scheme combining multi-round substitution encryption and the domestic SM4 symmetric encryption, balancing encryption complexity, computational efficiency, and domestic security compliance. The implementation logic of multi-round substitution encryption is as follows: First, a 62-bit character mapping table containing digits 0-9, lowercase letters az, and uppercase letters AZ is constructed, with a preset fixed number of encryption rounds rCount. During the operation, each character of the string to be encrypted is traversed round by round, and the character is replaced according to the character type and the position in the mapping table. After each round of replacement, the output result is used as the input for the next round. After rCount rounds of iterative transformation, the final encrypted string is output, effectively improving encryption complexity. The SM4 symmetric encryption algorithm adopts a standard block cipher algorithm independently developed in my country, with a block length and key length of 128 bits. During operation, the initial configuration of 128-bit plaintext, 128-bit key, and the required FK system parameters and CK fixed parameters for key expansion are first completed. The plaintext data is split into four 32-bit word structures, and the data is encrypted after 32 rounds of iterative key operations. The decryption process reverses the round key sequence, and finally, the final standard ciphertext is obtained by concatenating the keys in reverse order. Meanwhile, this application compiles and solidifies all core security parameters, such as the number of encryption rounds and the core encryption key, into the WebAssembly binary file, ensuring no plaintext source code is leaked on the front end, which greatly increases the difficulty of reverse engineering the algorithm.

[0084] IV. Technical Effects. This application achieves significant improvements in both performance and security by introducing WebAssembly encryption verification technology: First, the execution speed is greatly improved, with performance more than ten times faster than traditional JavaScript encryption schemes, and the time for a single core encryption verification in high-concurrency scenarios can be controlled within 30ms; Second, transmission security is comprehensively upgraded, with ciphertext comparison and verification used throughout the entire process, completely abandoning the plaintext transmission mode, which can effectively prevent various network attacks such as data tampering, request replay, and front-end reverse engineering; Third, the system has stronger adaptability and can stably support high-concurrency business scenarios with hundreds of millions of calls.

[0085] To address the technical shortcomings of traditional CAPTCHA risk control solutions, such as fixed verification strength, one-size-fits-all verification, poor user experience for normal users, and insufficient accuracy in blocking high-risk users, this application constructs a hierarchical, seamless verification system based on multi-dimensional dynamic risk assessment. It leverages real-time user risk profiles to achieve adaptive dynamic adjustment of verification strength, balancing risk control security with user experience. The overall strategy logic is as follows: Figure 5 The flowchart shown is for the risk grading verification strategy.

[0086] I. Construction of a Multi-Dimensional Risk User Model. This application builds a risk model based on comprehensive user data. The collected data dimensions include four main categories: user identification information, end-to-end behavioral data, transaction log data, and abnormal risk data. Specifically, it covers user ID, mobile phone number, access IP, device ID, ID card number, user access location, page clicks, browsing and searching, add-to-cart behavior, user historical orders, payment records, and abnormal operation records such as brute-force attacks and risk control interception. After big data normalization and processing, the risk weights of each dimension are dynamically calculated using a time decay algorithm, ultimately generating a multi-dimensional risk user model with dynamic iteration capabilities.

[0087] II. Real-time Risk Score Calculation. At the moment a user initiates a real-time business request, the system simultaneously collects dynamic feature information such as the user's device fingerprint, real-time request IP, and mobile phone number. The real-time features are then weighted and fused with a pre-built multi-dimensional risk user model to generate a quantitative risk score of 0-100 points in real time, accurately representing the risk level of a single user request.

[0088] III. Risk-Based Verification Strategy. This application employs a three-tiered differentiated verification mechanism based on risk scores. Verification difficulty is positively correlated with the risk score. The specific strategy is as follows: Tier 1 represents low-risk users, who undergo a seamless verification strategy without requiring any CAPTCHA operations. Tier 2 represents medium-risk users, who undergo human-machine verification using basic-strength CAPTCHAs. Tier 3 represents high-risk users, who undergo high-strength verification using enhanced-strength obfuscated CAPTCHAs. This tiered model can accurately intercept medium- and high-risk fraudulent activities while ensuring a seamless experience for low-risk, high-quality users. Furthermore, the tiered thresholds and verification strength can be flexibly adjusted according to business needs.

[0089] The technical solution of this application can be widely used in high-concurrency scenarios such as e-commerce promotions, commemorative collection flash sales, online government services, and high-frequency trading, where machine-generated orders and script-based batch requests are prone to occur. The following is a complete explanation of the actual implementation process of the solution, taking the flash sale of popular stamps on the China Post Online Business Platform as an example.

[0090] First, the system pre-collects historical, multi-dimensional data of platform users and dynamically calculates user risk characteristics using a time decay algorithm, constructing a multi-dimensional user risk model adapted to the stamp-buying scenario. Second, when a user enters the stamp product details page and initiates a purchase request, the system collects dynamic data in real time, including the user's device fingerprint, access IP, page dwell behavior, and click operations, quickly completing real-time risk score calculation. Third, the system matches differentiated verification strategies based on the user's risk score: high-quality, low-risk existing users can directly complete the order without verification and without any operational obstacles; new users and suspicious users with medium risk levels need to complete basic-strength graphic CAPTCHA verification; high-risk abnormal users need to complete high-strength obfuscated CAPTCHA verification. Finally, through high-strength human-machine verification, the system accurately identifies and blocks illegal requests from machine scripts and automated order-brushing programs, preventing bulk order-brushing behavior.

[0091] This solution has achieved excellent results in actual application on the China Post Online business platform, truly realizing a differentiated risk control effect of seamless access for normal users and strict blocking of abnormal users. It significantly reduces the false blocking rate of traditional risk control mechanisms and effectively improves the fairness of business flash sales and the user experience of ordinary users.

[0092] Example 3 This invention provides a contactless human-machine verification device based on WebAssembly. Figure 6 This is a schematic diagram of the structure of a contactless human-machine verification device based on WebAssembly, provided in an embodiment of the present invention. Figure 6 As shown, the device includes: Risk modeling unit 100 is used to collect multi-dimensional behavioral data, transaction data, abnormal operation data and user identification information of users, and dynamically calculate based on time decay algorithm to generate multi-dimensional risk user model; Verification building unit 200 is used to acquire the image verification code and perform multiple image obfuscation processing to generate an obfuscated verification code image that is resistant to machine recognition. At the same time, it compiles the encryption algorithm module into WebAssembly binary format and loads it into the front end. The hierarchical verification unit 300 is used to respond to users' real-time requests, collect the current user's device fingerprint, request IP and user identification information, and calculate the real-time risk score by weighting it with the multi-dimensional risk user model. Based on the risk score, it matches the corresponding risk level and executes the corresponding verification strategy, triggering the front end to display the obfuscated verification code image or pass the verification without verification, thus completing the hierarchical verification. The encrypted submission unit 400 is used to call the WebAssembly binary format encryption algorithm module to perform cryptographic calculations on the graphical verification result and generate verification ciphertext after the user completes the graphical verification based on the obfuscated verification code image displayed on the front end, and submits the verification ciphertext and the graphical verification result to the server together. The result processing unit 500 is used to compare the graphics verification result received by the server with the standard ciphertext generated locally using the same algorithm. If the comparison is consistent, the user is allowed to pass; otherwise, the current business process is blocked, and the abnormal behavior record is fed back to the multi-dimensional risk user model for iterative updates, thus completing the risk processing closed loop.

[0093] Regarding the apparatus in the above embodiments, the specific manner in which each unit performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0094] Example 4 To implement the methods of the above embodiments, the present invention also provides an electronic device, which includes a memory and a processor; wherein the processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement the various steps of the methods described above.

[0095] Example 5 To implement the above embodiments, this application also proposes a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the method described in the foregoing embodiments.

[0096] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0097] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0098] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A seamless human-computer verification method based on WebAssembly, characterized in that, include: Collect multi-dimensional behavioral data, transaction data, abnormal operation data and user identification information of users, and dynamically calculate based on time decay algorithm to generate multi-dimensional risk user model; The system acquires a graphical verification code image and performs multiple graphical obfuscation processes to generate an obfuscated verification code image that is resistant to machine recognition. At the same time, the encryption algorithm module is compiled into WebAssembly binary format and loaded into the front end. Respond to users' real-time requests, collect the current user's device fingerprint, request IP, and user identification information, and calculate a real-time risk score by weighting it with a multi-dimensional risk user model. Match the corresponding risk level according to the risk score and execute the corresponding verification strategy, triggering the front end to display an obfuscated CAPTCHA image or pass the verification without verification, thus completing the graded verification. After the user completes the graphical verification based on the obfuscated CAPTCHA image displayed on the front end, the WebAssembly binary format encryption algorithm module is called to perform cryptographic calculations on the graphical verification result and generate verification ciphertext. The verification ciphertext and the graphical verification result are then submitted to the server together. The server-side graph verification result is compared with the standard ciphertext generated locally using the same algorithm. If they match, the user is allowed to pass; otherwise, the current business process is blocked, and the abnormal behavior record is fed back to the multi-dimensional risk user model for iterative updates, thus completing the risk handling closed loop.

2. The method according to claim 1, characterized in that, Collect multi-dimensional user behavior data, transaction data, abnormal operation data, and user identification information. Dynamically calculate based on a time decay algorithm to generate a multi-dimensional risk user model, including: Obtain the user's user ID, mobile phone number, access IP, device ID, and ID card number as user identification information; Collect user location data, click data, browsing data, search data, and shopping cart addition data as behavioral data; Obtain user order and payment data as transaction data; Obtain brute-force attack records and risk control interception records as abnormal operation data; Using multi-dimensional data as input, dynamic weighted calculations are performed based on a time decay algorithm to generate the multi-dimensional risk user model.

3. The method according to claim 2, characterized in that, The image of the CAPTCHA is acquired and subjected to multiple image obfuscation processes to generate an obfuscated CAPTCHA image resistant to machine recognition, including: Apply random perturbation to the RGB three-channel pixel values ​​of the graphic verification code image; The perturbed image is subjected to weighted grayscale conversion, and the weights are assigned according to the human eye’s sensitivity to the red, green and blue channels. Noise, speckles and short line interference elements are randomly added to the grayscale converted image. Two gap regions are randomly selected in the image and their positions are swapped. The color difference between the text color and the background color in the image is adjusted to a range that is discernible to the human eye but difficult for a machine to separate, so that the text and the background form a visual fusion, and the anti-machine recognition obfuscation verification code image is output.

4. The method according to claim 3, characterized in that, Compile the encryption algorithm module into WebAssembly binary format and load it into the front end, including: The logic code for the encryption algorithm was written in C language, and the logic code was compiled into an encryption module in WebAssembly binary format; The encryption module in the WebAssembly binary format is loaded into the front-end browser environment via JavaScript. The encryption algorithm module is used to perform cryptographic calculations on the graphics verification results on the front end, and the encryption round number and encryption key are compiled into binary data in the WebAssembly binary format.

5. The method according to claim 4, characterized in that, Based on the risk score, match the corresponding risk level and execute the appropriate verification strategy, including: When the real-time risk score is lower than the first preset threshold, it is determined to be a low-risk level, and the verification-free pass strategy is implemented, and the front end does not display the obfuscated verification code image; When the real-time risk score is between the first preset threshold and the second preset threshold, it is determined to be of medium risk level, and the basic strength verification strategy is executed, and the front end displays the obfuscated verification code image of basic strength. When the real-time risk score is higher than the second preset threshold, it is determined to be a high-risk level, and an enhanced verification strategy is executed. The front end displays the enhanced obfuscated CAPTCHA image, wherein the verification strength is positively correlated with the real-time risk score.

6. The method according to claim 5, characterized in that, The record of this abnormal behavior will be fed back to the multi-dimensional risk user model for iterative updates, including: In response to inconsistent results from server-side comparison, the current user's business operation process is interrupted; The user identification information, device fingerprint, request IP, and operation time associated with this abnormal behavior will be recorded as risk behavior data. Risk behavior data is input into the multi-dimensional risk user model as new samples. The risk weight parameters of users in each dimension are recalculated based on the time decay algorithm, the multi-dimensional risk user model is updated, and the closed-loop iterative optimization of the risk model is completed.

7. A contactless human-machine verification device based on WebAssembly, characterized in that, include: The risk modeling unit is used to collect multi-dimensional behavioral data, transaction data, abnormal operation data and user identification information of users, and dynamically calculates and generates multi-dimensional risk user models based on the time decay algorithm. The verification building unit is used to acquire the image verification code and perform multiple image obfuscation processes to generate an obfuscated verification code image that is resistant to machine recognition. At the same time, it compiles the encryption algorithm module into WebAssembly binary format and loads it into the front end. The hierarchical verification unit is used to respond to users' real-time requests, collect the current user's device fingerprint, request IP and user identification information, and calculate the real-time risk score by weighting it with the multi-dimensional risk user model. Based on the risk score, it matches the corresponding risk level and executes the corresponding verification strategy, triggering the front end to display an obfuscated CAPTCHA image or pass the verification without verification, thus completing the hierarchical verification. The encrypted submission unit is used to call the WebAssembly binary format encryption algorithm module after the user completes the graphics verification based on the obfuscated verification code image displayed on the front end, to perform cryptographic calculations on the graphics verification result and generate verification ciphertext, and submit the verification ciphertext and the graphics verification result together to the server. The result processing unit is used to compare the graphics verification result received by the server with the standard ciphertext generated locally using the same algorithm. If the comparison matches, the user is allowed to pass; otherwise, the current business process is blocked, and the abnormal behavior record is fed back to the multi-dimensional risk user model for iterative updates, thus completing the risk processing closed loop.

8. The apparatus according to claim 7, characterized in that, The risk modeling unit is also used for: Obtain the user's user ID, mobile phone number, access IP, device ID, and ID card number as user identification information; Collect user location data, click data, browsing data, search data, and shopping cart addition data as behavioral data; Obtain user order and payment data as transaction data; Obtain brute-force attack records and risk control interception records as abnormal operation data; Using multi-dimensional data as input, dynamic weighted calculations are performed based on a time decay algorithm to generate the multi-dimensional risk user model.

9. An electronic device, characterized in that, Including processor and memory; The processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement the method as described in any one of claims 1-7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-7.

Images