Identity authentication method, device, equipment, medium and program product

Abstract

The application provides an identity authentication method, device, equipment, medium and program product, which can be applied to the field of artificial intelligence technology, and specifically relates to the field of identity recognition. The method comprises the following steps: acquiring a multi-modal behavior feature generated by an authorized user to be authenticated in a client operation process, and converting the multi-modal behavior feature into a fused behavior feature; inputting the fused behavior feature into a pre-trained Gaussian mixture model to obtain probability values of the fused behavior feature belonging to each Gaussian component, and performing weighted processing on the probability values based on the weights of each Gaussian component to obtain a comprehensive probability value; acquiring a baseline behavior model, determining the similarity between the fused behavior feature and the baseline behavior model, and combining the comprehensive probability value and the similarity to generate a final authentication score; and determining that the identity authentication of the user to be authenticated is passed in the case that the final authentication score is greater than a preset identity authentication threshold. In this way, the user experience and security are taken into account in the identity authentication.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence, specifically to the field of identity recognition technology, and more specifically to an identity authentication method, apparatus, device, medium, and program product. Background Technology

[0002] In today's digital age, to ensure the security of personal information and data, identity authentication technology has evolved into a diversified system including static passwords, dynamic tokens, and biometrics (such as fingerprints and facial recognition). However, static passwords are vulnerable to brute-force attacks, phishing attacks, and social engineering attacks, and the memory burden on users increases with the number of accounts. While dynamic tokens improve security, they rely on additional hardware devices, resulting in a poor user experience and the risk of third-party attacks. Biometrics, although convenient, are susceptible to forgery attacks, and the leakage of biometric data poses a permanent security threat. Existing identity authentication technologies struggle to balance user experience with high security. Summary of the Invention

[0003] In view of the above problems, embodiments of this application provide an identity authentication method, apparatus, device, medium, and program product.

[0004] According to a first aspect of this application, an identity authentication method is provided, comprising: acquiring multimodal behavioral features generated by an authorized user performing operations on a client, and converting the multimodal behavioral features into fused behavioral features; inputting the fused behavioral features into a pre-trained Gaussian mixture model to obtain probability values ​​of the fused behavioral features belonging to each Gaussian component, and weighting the probability values ​​based on the weights of each Gaussian component to obtain a comprehensive probability value, wherein the Gaussian mixture model is trained based on the target user's historical multimodal behavioral feature data, the Gaussian mixture model includes multiple Gaussian components, each Gaussian component representing a historical behavioral pattern of the target user; acquiring a baseline behavioral model, determining the similarity between the fused behavioral features and the baseline behavioral model, and combining the comprehensive probability value and the similarity to generate a final authentication score, wherein the baseline behavioral model is constructed based on the target user's historical multimodal behavioral feature data; and determining that the identity authentication of the user to be authenticated is successful if the final authentication score is greater than a preset identity authentication threshold.

[0005] According to an embodiment of this application, the method further includes: obtaining a fusion behavior feature sequence of the user to be authenticated within a preset time window, and constructing a real-time behavior probability distribution based on the fusion behavior feature sequence; calculating the relative entropy between the real-time behavior probability distribution and the baseline probability distribution corresponding to the baseline behavior model; and, when the user to be authenticated passes authentication or the current risk level meets preset update conditions, determining an adjustment strategy for the Gaussian mixture model and / or the baseline behavior model based on the relationship between the relative entropy and at least one preset entropy threshold, and adjusting the Gaussian mixture model and / or the baseline behavior model.

[0006] According to embodiments of this application, the adjustment strategy of the Gaussian mixture model includes at least one of the following: feature weight adjustment, model incremental update, and model reconstruction.

[0007] According to an embodiment of this application, the entropy threshold includes a first entropy threshold and a second entropy threshold, wherein the first entropy threshold is less than the second entropy threshold; the step of determining an adjustment strategy for the Gaussian mixture model and adjusting the Gaussian mixture model based on the relationship between the relative entropy and at least one preset entropy threshold includes: adjusting the feature weights of the Gaussian mixture model based on the relative entropy when the relative entropy is less than the first entropy threshold; incrementally updating the Gaussian mixture model based on the fusion behavior feature sequence when the relative entropy is greater than or equal to the first entropy threshold and less than the second entropy threshold; and reconstructing the Gaussian mixture model using the expectation-maximization algorithm based on the fusion behavior feature sequence when the relative entropy is greater than or equal to the second entropy threshold.

[0008] According to an embodiment of this application, the incremental update of the Gaussian mixture model based on the fused behavioral feature sequence includes: determining the risk level of the real-time operational behavior when it is determined that the real-time operational behavior of the user to be authenticated has a stable drift; if the risk level is a first risk level, using the fused behavioral feature sequence as a model update sample set for the shadow model corresponding to the Gaussian mixture model, wherein the first risk level is used to characterize that the risk of the real-time operational behavior is lower than a preset risk threshold; training the shadow model based on the model update sample set, and performing a preset number of cross-validations on the trained shadow model; if the cross-validation pass rate is greater than a preset pass rate threshold, fusing the model parameters of the shadow model with the model parameters of the Gaussian mixture model.

[0009] According to an embodiment of this application, the method further includes: when the risk level is a second risk level, pushing an enhanced verification request to the user to be authenticated, and stopping the updating of the Gaussian mixture model based on the fusion behavior feature sequence, wherein the second risk level is used to characterize that the risk of the real-time operation behavior is greater than or equal to a preset risk threshold, and the enhanced verification request includes at least one of the following: static password authentication, dynamic token authentication, and biometric authentication.

[0010] According to an embodiment of this application, the step of inputting the fused behavioral feature into a pre-trained Gaussian mixture model to obtain the probability value of the fused behavioral feature belonging to each Gaussian component, and weighting the probability value based on the weight of each Gaussian component to obtain a comprehensive probability value, includes: obtaining the current authentication timestamp and / or the current scene mode, and determining the target time interval to which the current authentication timestamp belongs, wherein the target time interval is any one of a plurality of pre-divided periodic time intervals; according to the preset mapping relationship between the periodic time interval and / or the current scene mode and the Gaussian mixture model, retrieving a target Gaussian mixture model that matches the target time interval and / or the current scene mode; inputting the fused behavioral feature into the target Gaussian mixture model to obtain the probability value of the fused behavioral feature belonging to each Gaussian component in the target Gaussian mixture model; and weighting the probability value based on the weight of each Gaussian component in the target Gaussian mixture model to obtain the comprehensive probability value.

[0011] According to an embodiment of this application, the preset identity authentication threshold is a dynamic identity authentication threshold, which is determined based on a basic authentication threshold, a risk adjustment item, and a rhythm adjustment item; wherein, the risk adjustment item is determined based on a risk level assessment coefficient and a risk sensitivity coefficient, and the rhythm adjustment item is determined based on the current authentication time, the target user's historical peak behavior time, and the rhythm cycle.

[0012] According to a second aspect of this application, an identity authentication device is provided, comprising: a feature conversion module, configured to acquire multimodal behavioral features generated by an authorized user performing operations on a client, and convert the multimodal behavioral features into fused behavioral features; a probability value acquisition module, configured to input the fused behavioral features into a pre-trained Gaussian mixture model, obtain probability values ​​of the fused behavioral features belonging to each Gaussian component, and perform weighted processing on the probability values ​​based on the weights of each Gaussian component to obtain a comprehensive probability value, wherein the Gaussian mixture model is trained based on the historical multimodal behavioral feature data of the target user, the Gaussian mixture model includes multiple Gaussian components, each Gaussian component representing a historical behavioral pattern of the target user; a score generation module, configured to acquire a baseline behavioral model, determine the similarity between the fused behavioral features and the baseline behavioral model, and combine the comprehensive probability value and the similarity to generate a final authentication score, wherein the baseline behavioral model is constructed based on the historical multimodal behavioral feature data of the target user; and an identity authentication module, configured to determine that the identity authentication of the user to be authenticated is successful if the final authentication score is greater than a preset identity authentication threshold.

[0013] According to a third aspect of this application, an electronic device is provided, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0014] According to a fourth aspect of this application, a computer-readable storage medium is also provided, on which a computer program or instructions are stored, wherein the computer program or instructions, when executed by a processor, implement the steps of the above-described method.

[0015] According to a fifth aspect of this application, a computer program product is also provided, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method.

[0016] The method provided in this application uses a Gaussian mixture model to model multiple historical behavioral patterns of a target user. When authentication is required, the method acquires the real-time multimodal behavioral features of the user to be authenticated and inputs the transformed fused behavioral features into the Gaussian mixture model to obtain the comprehensive probability value of the real-time behavioral pattern of the user to be authenticated belonging to the multiple historical behavioral patterns of the target user represented by the Gaussian mixture model. Then, the similarity between the fused behavioral features of the user to be authenticated and the baseline behavioral model is determined. The final authentication score of the user to be authenticated is generated by combining the comprehensive probability value and the similarity, and authentication is performed based on the final authentication score. This final authentication score not only represents the comprehensive probability value of the real-time behavioral pattern of the user to be authenticated belonging to the multiple historical behavioral patterns of the target user, but also represents the similarity between the user's behavior and the baseline behavior, enabling more accurate user authentication. Furthermore, the entire authentication process does not require the user to input additional static passwords, dynamic tokens, or biometric information, reducing user operation complexity and improving user experience. In addition, user behavioral patterns are more difficult for attackers to obtain than static passwords, dynamic tokens, and biometric information; the technical solution provided in this application can better ensure the security of the authentication process. Attached Figure Description

[0017] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0018] Figure 1 The illustrations depict application scenarios of identity authentication methods, apparatuses, devices, media, and program products according to embodiments of this application.

[0019] Figure 2 A flowchart illustrating an identity authentication method according to an embodiment of this application is shown schematically;

[0020] Figure 3 This illustration schematically shows an authentication process flowchart under three stages according to an embodiment of this application;

[0021] Figure 4 This schematic diagram illustrates a structural block diagram of an identity authentication device according to an embodiment of this application;

[0022] Figure 5 A block diagram schematically illustrates an electronic device suitable for implementing an authentication method according to an embodiment of this application. Detailed Implementation

[0023] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0024] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0025] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0026] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0027] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0028] In scenarios where personal information is used for automated decision-making, the methods, devices, and systems provided in this application all provide users with corresponding operation entry points for users to choose to agree to or reject the automated decision results; if the user chooses to reject, the process enters the expert decision-making process.

[0029] As used in this paper, the term "model" refers to a model that learns the relationship between inputs and outputs from training data, enabling it to generate corresponding outputs for a given input after training. Model generation can be based on machine learning techniques. Deep learning is a machine learning algorithm that processes inputs and provides corresponding outputs using multiple layers of processing units. A neural network model is an example of a deep learning-based model. In this paper, "model" may also be referred to as a "machine learning model," "learning model," "machine learning network," or "learning network," and these terms are used interchangeably.

[0030] It's important to note that the term "neural network" can refer to a machine learning network based on deep learning. A neural network processes input and provides corresponding output, typically consisting of an input layer, an output layer, and one or more hidden layers between them. Neural networks used in deep learning applications often include many hidden layers, increasing the network's depth. The layers of a neural network are connected sequentially, so that the output of the previous layer serves as the input to the next layer. The input layer receives the input to the neural network, while the output layer's output becomes the final output. Each layer of a neural network includes one or more nodes (also called processing nodes or neurons), each processing the input from the layer above.

[0031] It should be understood that machine learning generally includes three phases: training, testing, and application (also known as inference). In the training phase, a given model is trained using a large amount of training data, iteratively updating parameter values ​​until the model can consistently generate inferences that meet the expected goals from the training data. Through training, the model can be considered to have learned the relationship between inputs and outputs (also known as the input-output mapping) from the training data. The parameter values ​​of the trained model are determined. In the testing phase, test inputs are applied to the trained model to test whether it can provide the correct output, thus determining the model's performance. In the application phase, the model can be used to process actual inputs based on the trained parameter values ​​to determine the corresponding output.

[0032] In today's digital age, to ensure the security of personal information and data, identity authentication technology has evolved into a diversified system including static passwords, dynamic tokens, and biometrics (such as fingerprints and facial recognition). However, static passwords are vulnerable to brute-force attacks, phishing attacks, and social engineering attacks, and the memory burden on users increases with the number of accounts. While dynamic tokens improve security, they rely on additional hardware devices, resulting in a poor user experience and the risk of third-party attacks. Biometrics, although convenient, are susceptible to forgery attacks, and the leakage of biometric data poses a permanent security threat. Existing identity authentication technologies struggle to balance user experience with high security.

[0033] In view of the above problems, embodiments of this application provide an identity authentication method, apparatus, device, medium, and program product. The following will describe the above operations in conjunction with the accompanying drawings and textual description to achieve at least one objective of this application.

[0034] Figure 1 The illustrations depict application scenarios of identity authentication methods, apparatuses, devices, media, and program products according to embodiments of this application. For example... Figure 1 As shown, application scenario 100 according to an embodiment of this application may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables. For example, a user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send information, etc.

[0035] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be electronic devices such as smartphones, wearable devices, personal computers, intelligent voice interaction devices, smart home appliances, intelligent vehicles, in-vehicle terminals, aircraft, unmanned vending terminals, and extended reality devices. Extended reality devices can include virtual reality devices, augmented reality devices, and mixed reality devices. A client application for the target application can be installed and run on the terminal devices. This target application can include, but is not limited to, financial transaction applications, payment applications, shopping applications, web browser applications, search applications, instant messaging tools, email clients, and social media platform software (these are just examples). Furthermore, this application embodiment does not limit the form of the target application, and it can include, but is not limited to, applications, mini-programs, etc., installed on the terminal devices, and can also be in the form of web pages.

[0036] Server 105 can be a server providing various services, such as a backend management server supporting websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process received user requests and other data, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices. The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services such as cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks, and basic cloud computing services such as big data. The server can be the backend server of the aforementioned target application, used to provide backend services to the clients of the target application.

[0037] It should be noted that the authentication method provided in this application embodiment can generally be executed by server 105 and / or terminal devices 101-103. Accordingly, the authentication device provided in this application embodiment can generally be set in server 105 and / or terminal devices 101-103.

[0038] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0039] The following is based on Figure 1 The scenario described herein provides a detailed description of the identity authentication method provided in the embodiments of this application.

[0040] Figure 2 A flowchart illustrating an identity authentication method according to an embodiment of this application is shown schematically. Figure 2 As shown, the identity authentication method 200 according to the embodiments of this application may include steps S210 to S240.

[0041] In step S210, the multimodal behavioral features generated by the authorized user during the operation on the client are obtained, and the multimodal behavioral features are converted into fused behavioral features.

[0042] In embodiments of this application, multimodal behavioral features may include: keyboard interaction features, touchscreen interaction features, and device motion features.

[0043] Keyboard interaction characteristics can include: keystroke timing characteristics, keystroke pressure characteristics, and input error patterns. Keystroke timing characteristics can include: the time interval between keys and the duration of keystrokes. Keystroke pressure characteristics can include: the distribution of key pressure acquired through a pressure-sensitive screen or keyboard. Input error patterns can include: the frequency of backspace key usage and the rhythm of error correction. For each keystroke event, a triplet can be recorded. Where k is the key code. To press the timestamp, To release the timestamp. Keep the time. Flight time = .

[0044] Touchscreen interaction characteristics can include: swipe trajectory characteristics, touch operation characteristics, and gesture habits. Swipe trajectory characteristics can include: swipe speed variation curves, acceleration patterns, and trajectory curvature. Touch operation characteristics can include: single-point touch area changes and relative positions of multi-point touches. Gesture habits can include: the force and time distribution of complex gestures such as zooming and rotating. For touch trajectories, a parametric representation can be used, where the sequence of touch points is denoted as... , ,in For touch point Location coordinates, For touch point The elapsed time. Then instantaneous velocity at a moment It can be represented as:

[0045]

[0046] in, For touch point The passing of time.

[0047] Device motion characteristics can include: holding posture, micro-vibrations during operation, and device displacement. Holding posture can include: the spatial angle of the device acquired by gyroscopes and accelerometers. Micro-vibrations during operation can include: the high-frequency vibration spectrum of the device caused by finger operation. Device displacement can include: the overall movement trajectory of the device during operation.

[0048] In the embodiments of this application, when a user to be authenticated needs to log in to the target user's account, they can first enter account information on a client deployed on the terminal device. During the process of the user entering account information on the client deployed on the terminal device, after authorization by the user to be authenticated, the server can collect the user's behavioral data through different types of sensors built into the terminal device, and then obtain the aforementioned multimodal behavioral characteristics of the user to be authenticated from the collected behavioral data.

[0049] In the embodiments of this application, the consent or authorization of the user to be authenticated can be obtained before collecting the user's behavioral data. For example, before step S210, when the user to be authenticated starts entering account information to log in on the client interface, a request to collect the user's behavioral data can be sent to the user, informing the user of the scope and purpose of the data to be collected. If the user agrees or authorizes the relevant data collection, the user's behavioral data is collected through corresponding sensors within the authorized scope, thereby obtaining the user's multimodal behavioral features and converting them into fused behavioral features, i.e., executing step S210.

[0050] After obtaining the aforementioned multimodal behavioral features, the server can fuse these features into fused behavioral features. For example, after obtaining the keyboard interaction features f={ }, Touchscreen interaction features s={ }, and the motion characteristics of the equipment m={ After that, these features are converted into fused behavioral features. .

[0051] In some embodiments, after acquiring multimodal behavioral features, the server may first perform feature preprocessing and normalization on the acquired multimodal behavioral features, and then perform feature fusion transformation to eliminate the influence of device differences and session environment. The aforementioned feature preprocessing and normalization may include: temporal normalization, spatial normalization, device calibration, etc., and each processing method is described in detail below.

[0052] 1. Time normalization.

[0053] Considering the differences in user operation speed in different scenarios, a relative time metric is used:

[0054]

[0055] in, The timestamp after normalization The raw data collected includes, for example, the hold time and flight time in the keyboard interaction features mentioned above. and These are the mean and standard deviation of the target user's historical behavior data, such as the mean and standard deviation of the retention time corresponding to the target user's historical keystroke behavior.

[0056] 2. Spatial normalization.

[0057] For touch operations on screens of different sizes, the original position coordinates are converted into relative positions:

[0058]

[0059] Where w and h are the width and height of the screen, respectively, and x and y are the original position coordinates, such as the position coordinates of the touch point in the touch screen interaction features described above. This represents the converted relative position.

[0060] 3. Equipment calibration.

[0061] Sensor data is mapped to a standard space using a device-specific calibration parameter matrix M and a deviation vector B:

[0062]

[0063] in, To calibrate the equipment's motion parameters, The raw data collected includes, for example, the spatial angles of the equipment, the high-frequency vibration spectrum of the equipment, and the overall movement trajectory of the equipment, as described above. For the device feature matrix, The deviation vector is the parameter matrix. Both the device feature matrix and the deviation vector are obtained by different devices based on their device parameters. For example, the calibration parameter matrix and deviation vector corresponding to a touchscreen can be obtained from at least one of the following device parameters: sampling rate, reporting accuracy, pressure sensing resolution, edge positioning deviation, edge blind zone width, and signal attenuation rate. Among these, edge positioning deviation, edge blind zone width, and signal attenuation rate are used to characterize the edge response characteristics of the touchscreen.

[0064] In step S220, the fused behavioral features are input into a pre-trained Gaussian mixture model to obtain the probability values ​​of the fused behavioral features belonging to each Gaussian component. The probability values ​​are then weighted based on the weights of each Gaussian component to obtain a comprehensive probability value.

[0065] Gaussian mixture models (GMMs) are probabilistic generative models capable of modeling complex data distributions. In the embodiments of this application, the GMM is trained based on the historical multimodal behavioral feature data of the target user. The GMM includes multiple Gaussian components, each representing a historical behavioral pattern of the target user. In the behavioral analysis of the target user, by treating the historical multimodal behavioral features as random variables generated by the mixture of multiple Gaussian distributions, a GMM is established to capture the multimodality and individual uniqueness of the target user's behavior.

[0066] In embodiments of this application, the fused behavioral features can be input into a pre-trained Gaussian mixture model (GMM), which generates probability values ​​for each Gaussian component. These probability values ​​are then weighted based on the weights of each Gaussian component to obtain a comprehensive probability value. For example, the comprehensive probability value can be calculated using the following formula:

[0067]

[0068] in, and Both represent the comprehensive probability value, and V is the fused behavior feature vector. These are the model parameters for the Gaussian mixture model. To fuse the behavioral feature vector dimensions, For the first Gaussian component weights. Let be the Gaussian distribution function corresponding to the i-th Gaussian component. Let be the mean of the i-th Gaussian component. Let be the covariance matrix corresponding to the i-th Gaussian component.

[0069] In step S230, a baseline behavior model is obtained, the similarity between the fused behavior features and the baseline behavior model is determined, and the final authentication score is generated by combining the comprehensive probability value and the similarity.

[0070] In the embodiments of this application, the baseline behavior model is constructed based on the historical multimodal behavior feature data of the target user. The baseline behavior model characterizes the baseline behavior mean and baseline behavior covariance matrix of the target user's historical multimodal behavior, and the similarity between the fused behavior features and the baseline behavior model can be determined based on the baseline behavior mean and baseline behavior covariance matrix. For example, the similarity can be determined using the following formula:

[0071]

[0072] in, Indicates similarity. and These are the baseline behavior mean and baseline behavior covariance matrix, respectively. for The transpose of .

[0073] In the embodiments of this application, after obtaining the comprehensive probability value and similarity score, a weighted average can be applied to generate the final authentication score. For example, the final authentication score can be generated using the following formula. :

[0074]

[0075] in, The weighting coefficients for the overall probability value. The similarity weighting coefficients, It can take any value between 0 and 1, and the specific value can be set according to the actual situation. There are no restrictions on this.

[0076] In step S240, if the final authentication score is greater than the preset identity authentication threshold, the user to be authenticated is determined to have passed the identity authentication.

[0077] In the embodiments of this application, the final authentication score can be compared with a preset identity authentication threshold to determine the relationship between the two. If the final authentication score is greater than the preset identity authentication threshold, the user's identity can be determined to have been successfully authenticated. The user can then use the target user's account on the client to conduct relevant business, such as performing financial transactions.

[0078] According to embodiments of this application, a Gaussian mixture model is used to model multiple historical behavioral patterns of a target user. When authentication of a user is required, the real-time multimodal behavioral features of the user to be authenticated are obtained, and the transformed fused behavioral features are input into the Gaussian mixture model to obtain a comprehensive probability value that the real-time behavioral pattern of the user to be authenticated belongs to the multiple historical behavioral patterns of the target user represented by the Gaussian mixture model. Then, the similarity between the fused behavioral features of the user to be authenticated and the baseline behavioral model is determined. The final authentication score of the user to be authenticated is generated by combining the comprehensive probability value and the similarity, and authentication is performed based on the final authentication score. This final authentication score not only represents the comprehensive probability value that the real-time behavioral pattern of the user to be authenticated belongs to the multiple historical behavioral patterns of the target user, but also represents the similarity between the user's behavior and the baseline behavior, enabling more accurate user authentication. Furthermore, the entire authentication process does not require the user to input additional static passwords, dynamic tokens, or biometric information, reducing user operation complexity and improving user experience. In addition, user behavioral patterns are more difficult for attackers to obtain than static passwords, dynamic tokens, and biometric information; the technical solution provided by this application can better guarantee the security of the authentication process.

[0079] In some embodiments, relative entropy can also be used to monitor changes in the behavior distribution of the user to be authenticated, and the Gaussian mixture model and / or baseline behavior model can be adjusted in a timely manner when user behavior changes. According to embodiments of this application, the fused behavior feature sequence of the user to be authenticated within a preset time window can be obtained first, and a real-time behavior probability distribution can be constructed based on the fused behavior feature sequence; then, the relative entropy between the real-time behavior probability distribution and the baseline probability distribution corresponding to the baseline behavior model can be calculated; when the user to be authenticated passes authentication or the current risk level meets preset update conditions, the adjustment strategy for the Gaussian mixture model and / or baseline behavior model can be determined and adjusted based on the relationship between the relative entropy and at least one preset entropy threshold.

[0080] In the embodiments of this application, the preset time window can be a continuous observation interval extracted from the current moment and traced back in the historical direction for a preset duration. The preset duration can be 1 minute, 3 minutes, etc., and can be set according to the actual situation, without limitation. The real-time behavior probability distribution and the baseline probability distribution can be Gaussian distributions, or other probability distributions that can describe the patterns of user behavior, without limitation. The preset update condition is that the risk of the current user's real-time operation behavior is lower than a preset risk threshold. The preset risk threshold can be determined based on the amount involved in the operation behavior, the scope of impact, etc.

[0081] In the embodiments of this application, a probability distribution type can be selected first, and then the key parameters of the selected probability distribution can be calculated based on the fused behavioral feature sequence to complete the construction of the real-time behavioral probability distribution. For example, if the probability distribution type is selected as Gaussian distribution, the mean and covariance matrix of the Gaussian distribution can be calculated using the maximum likelihood estimation algorithm based on the fused behavioral feature sequence to obtain the real-time behavioral probability distribution.

[0082] The baseline probability distribution can be constructed based on the baseline behavior mean and baseline behavior covariance matrix represented by the baseline behavior model. After obtaining the real-time behavior probability distribution, the relative entropy between the real-time behavior probability distribution and the baseline probability distribution corresponding to the baseline behavior model can be calculated to determine the adjustment strategy for the Gaussian mixture model and / or the baseline behavior model.

[0083] In some embodiments, the adjustment strategy for the Gaussian mixture model may include at least one of the following: feature weight adjustment, incremental model update, and model reconstruction. Feature weight adjustment includes adjusting the feature weights of some Gaussian components; incremental model update includes incrementally updating the Gaussian mixture model based on new behavioral samples of the target user; and model reconstruction includes rebuilding the Gaussian mixture model based on new behavioral samples of the target user. According to the embodiments of this application, different adjustment strategies for the Gaussian mixture model can be determined, thereby allowing for targeted adjustments to the Gaussian mixture model and further improving the accuracy of identity authentication based on the Gaussian mixture model.

[0084] In some embodiments, the adjustment strategy for the baseline behavior model may include updating the baseline behavior model and reconstructing the baseline behavior model. Updating the baseline behavior model may include updating the baseline behavior mean and baseline behavior covariance matrix represented by the baseline behavior model based on new behavior samples of the target user; reconstructing the baseline behavior model may include recalculating the baseline behavior mean and baseline behavior covariance matrix represented by the baseline behavior model based on new behavior samples of the target user. According to embodiments of this application, different adjustment strategies for the baseline behavior model can be determined, thereby allowing for targeted adjustments to the baseline behavior model and further improving the accuracy of identity authentication based on the baseline behavior model.

[0085] Before adjusting the Gaussian mixture model and / or baseline behavior model, it is advisable to determine whether the user to be authenticated has passed identity verification or whether the current risk level meets the preset update conditions. If the user to be authenticated has not passed identity verification and the current risk level does not meet the preset update conditions, the Gaussian mixture model and / or baseline behavior model will not be adjusted.

[0086] If the user's identity is successfully authenticated or the current risk level meets the preset update conditions, the relationship between the relative entropy and at least one preset entropy threshold can be determined. This allows for the determination of an adjustment strategy for the Gaussian mixture model and / or the baseline behavioral model, and the adjustment of the Gaussian mixture model and / or the baseline behavioral model. For example, the preset entropy threshold may include a target entropy threshold. If the relative entropy is greater than or equal to the target entropy threshold, an adjustment strategy for the Gaussian mixture model and / or the baseline behavioral model can be determined, and the Gaussian mixture model and / or the baseline behavioral model can be adjusted. If the relative entropy is less than the target entropy threshold, no adjustment is made to the Gaussian mixture model and / or the baseline behavioral model.

[0087] According to embodiments of this application, an adjustment strategy for the Gaussian mixture model and / or baseline behavior model is determined and adjusted based on the relationship between relative entropy and at least one preset entropy threshold. By determining targeted adjustment strategies for the Gaussian mixture model and / or baseline behavior model based on different relationships between relative entropy and entropy thresholds, and then specifically adjusting the Gaussian mixture model and / or baseline behavior model, the accuracy of identity authentication based on the Gaussian mixture model is further improved.

[0088] In some embodiments, the entropy threshold may include a first entropy threshold and a second entropy threshold, wherein the first entropy threshold is less than the second entropy threshold, and the first and second entropy thresholds may be set according to actual conditions.

[0089] Based on the above three adjustment strategies for Gaussian mixture models, and according to the relationship between relative entropy and at least one preset entropy threshold in the embodiments of this application, the adjustment strategy for Gaussian mixture models is determined and the Gaussian mixture model is adjusted. This can include: adjusting the feature weights of the Gaussian mixture model based on the relative entropy when the relative entropy is less than the first entropy threshold; incrementally updating the Gaussian mixture model based on the fusion behavior feature sequence when the relative entropy is greater than or equal to the first entropy threshold and less than the second entropy threshold; and reconstructing the Gaussian mixture model using the expectation-maximization algorithm based on the fusion behavior feature sequence when the relative entropy is greater than or equal to the second entropy threshold.

[0090] In the embodiments of this application, a first entropy threshold and a second entropy threshold can be preset, and the relative entropy can be compared with the first entropy threshold and the second entropy threshold respectively to determine the magnitude relationship between the relative entropy and the first entropy threshold and the entropy threshold respectively.

[0091] If the relative entropy is less than the first entropy threshold, it indicates that the behavioral habits of the user to be authenticated fluctuate relatively little. Therefore, the Gaussian mixture model (GMM) does not need to be adjusted. Alternatively, the feature weights of some Gaussian components in the GMM can be fine-tuned based on the relative entropy. In the embodiments of this application, behavioral features of modes with relatively large fluctuations, such as keyboard interaction features, can be determined based on local relative entropy. Then, feature weight adjustment coefficients can be determined based on the relative entropy to adjust the feature weights of that Gaussian component.

[0092] If the relative entropy is greater than or equal to the first entropy threshold and less than the second entropy threshold, it indicates that the behavior of the user to be authenticated has reached a certain level but is not excessive, and the Gaussian mixture model can be incrementally updated. In the embodiments of this application, the fused behavioral feature sequence of the user to be authenticated can be used as a new behavioral sample to incrementally update the Gaussian mixture model.

[0093] If the relative entropy is greater than or equal to the second entropy threshold, it indicates that the user's behavior has fluctuated significantly and has changed, suggesting that the Gaussian mixture model can be reconstructed. In the embodiments of this application, the fused behavioral feature sequence of the user to be authenticated can be used as a new behavioral sample to reconstruct the Gaussian mixture model.

[0094] To illustrate more clearly how the above adjustment strategy is determined, a detailed example is provided below. In one example, the first entropy threshold is... The second entropy threshold is The relative entropy is .

[0095] When the relative entropy is less than the first entropy threshold, that is, when the relative entropy is in the interval (0, ..., ...) The feature weights of a Gaussian mixture model can be adjusted based on the following formula:

[0096]

[0097] in, To adjust the feature weights of the i-th Gaussian component, The feature weights of the i-th Gaussian component before adjustment.

[0098] When the relative entropy is greater than or equal to the first entropy threshold and less than the second entropy threshold, that is, when the relative entropy is in the interval [ , The Gaussian mixture model can be incrementally updated based on the following formula:

[0099]

[0100] in, Let be the model parameters of the Gaussian mixture model at time t. Let be the model parameters of the Gaussian mixture model at time t-1. The learning rate of the Gaussian mixture model is used to control the update step size. Objective function for model training Regarding model parameters The gradient.

[0101] When the relative entropy is greater than or equal to the second entropy threshold, i.e., the relative entropy is in the interval [ , The Gaussian mixture model can be reconstructed based on the following formula:

[0102] )

[0103] in, To reconstruct the new model parameters of the Gaussian mixture model, To fuse behavioral feature sequences, K represents the number of clustering components in the Gaussian mixture model, i.e., the number of Gaussian components. This is an expectation-maximization algorithm based on the fusion of behavioral feature sequences and the number of Gaussian components.

[0104] According to embodiments of this application, adjustments to the Gaussian mixture model and / or baseline behavior model are determined specifically based on different entropy threshold ranges to which the relative entropy belongs, thereby adjusting the Gaussian mixture model and / or baseline behavior model in a targeted manner, further improving the accuracy of identity authentication based on the Gaussian mixture model.

[0105] In some embodiments, to avoid improper model updates affecting the authentication performance of the Gaussian mixture model, it can be determined whether the user's operation behavior shows stable drift and whether the risk level is low before updating the Gaussian mixture model.

[0106] In the embodiments of this application, the similarity between the real-time operational behavior of the user to be authenticated and the baseline behavioral model can be used to measure whether the drift is stable. If the similarity between the real-time operational behavior of the user to be authenticated and the baseline behavioral model shows a slow changing trend, it can be determined that the operational behavior of the user to be authenticated has undergone stable drift; if the similarity between the operational behavior of the user to be authenticated and the baseline behavioral model shows a drastic change, it can be determined that the operational behavior of the user to be authenticated has undergone unstable drift.

[0107] In the event of unstable drift in the user's actions, enhanced authentication can be triggered. This involves pushing an enhanced verification request to the user, stopping updates to the Gaussian mixture model, and freezing the model parameters. The enhanced verification request can include at least one of the following: static password authentication, dynamic token authentication, or biometric authentication.

[0108] If the real-time operational behavior of the user to be authenticated shows a stable drift, the risk level of the real-time operational behavior can be determined; if the risk level is the first risk level, which represents the risk of the real-time operational behavior being lower than the preset risk threshold, then subsequent model updates can be performed.

[0109] In some embodiments, when the risk level is a second risk level, representing a risk greater than or equal to a preset risk threshold (characterized by real-time operational behavior), an enhanced verification request can be pushed to the user to be authenticated, and updates to the Gaussian mixture model based on the fused behavioral feature sequence can be stopped. Thus, in cases of high risk, the user to be authenticated is requested to undergo enhanced verification, while updates to the Gaussian mixture model are stopped, and the model parameters of the Gaussian mixture model are frozen. This prevents attacks from affecting the target user's normal identity authentication, further improving the security of identity authentication based on the Gaussian mixture model.

[0110] In the embodiments of this application, before updating the Gaussian Mixture Model (GMM), the behavioral samples used for updating can be added to the training pool of the shadow model corresponding to the GMM to update the shadow model, and cross-validation can be performed on the updated shadow model. After the cross-validation is successful, the update of the shadow model is synchronized to the GMM to ensure the stability of the GMM.

[0111] For example, the fused behavioral feature sequence can be used as the model update sample set for the shadow model corresponding to the Gaussian mixture model. The shadow model is then trained based on this update sample set, and cross-validation is performed on the trained shadow model a predetermined number of times. If the cross-validation pass rate is greater than a predetermined pass rate threshold, the model parameters of the shadow model are fused with those of the Gaussian mixture model. The predetermined pass rate threshold can be adjusted according to actual needs; if higher model accuracy is required, the threshold can be appropriately increased. In one example, the predetermined pass rate threshold could be 95%, without limitation.

[0112] According to embodiments of this application, before updating the Gaussian Mixture Model (GMM), it is first determined whether the real-time operational behavior of the user to be authenticated has experienced stable drift. The GMM is only updated if stable drift occurs, thus preventing the target user's account from being attacked. After determining that the user's real-time operational behavior has experienced stable drift, the risk level of the user's real-time operational behavior is further determined. The GMM is only updated if the risk level is low, further improving the security of identity authentication based on the GMM. Furthermore, the GMM is updated using a dual-model structure. If the updated shadow model passes cross-validation, the model parameters of the shadow model are fused with the model parameters of the GMM, ensuring the stability of the GMM and thus improving the accuracy of identity authentication based on the GMM.

[0113] Since the behavior of target users may fluctuate naturally, embodiments of this application can introduce behavioral rhythm modeling into a Gaussian mixture model to establish a time-period-based behavioral feature distribution model for the target user. In this case, a matching target Gaussian mixture model can be retrieved based on the target time interval to which the current authentication timestamp of the user to be authenticated belongs and / or the current scene mode to obtain a comprehensive probability value.

[0114] In the embodiments of this application, the current authentication timestamp and / or the current scene mode can be obtained first, and the target time interval to which the current authentication timestamp belongs can be determined; according to the preset periodic time period and / or the mapping relationship between the current scene mode and the Gaussian mixture model, the target Gaussian mixture model that matches the target time interval and / or the current scene mode can be retrieved; the fused behavioral features are input into the target Gaussian mixture model to obtain the probability values ​​of the fused behavioral features belonging to each Gaussian component in the target Gaussian mixture model; based on the weights of each Gaussian component in the target Gaussian mixture model, the probability values ​​are weighted to obtain the comprehensive probability value.

[0115] The target time interval can be any of several pre-defined periodic time intervals. The periodic time intervals can be divided based on whether it is a weekday or not, and the morning, noon, and evening of the day. For example, Monday to Friday can be divided into "weekdays", Saturday and Sunday into "rest days", 2:00 AM to 10:00 AM into "morning period", 10:00 AM to 6:00 PM into "noon period", and 6:00 PM to 2:00 AM into "evening period".

[0116] The current scene mode can include work mode and leisure mode. The current scene mode can be obtained based on the geographical location of the terminal device or the terminal device mode set by the user to be authenticated. For example, if the user to be authenticated sets their terminal device mode to work mode, then the current scene mode will be work mode.

[0117] After obtaining the current authentication timestamp, the target time interval to which the current authentication timestamp belongs can be determined based on the current authentication timestamp. For example, if the current authentication timestamp is 14:59 on Thursday, June 4, 2026, the target time interval described by the current authentication timestamp can be determined to be "the midday period on weekdays".

[0118] Furthermore, based on the mapping relationship between the target time interval and / or the current scene mode and the Gaussian mixture model, a target Gaussian mixture model that matches the target time interval and / or the current scene mode can be retrieved. For example, if the target time interval is "lunchtime on weekdays" and the current scene mode is "work mode", the target Gaussian mixture model corresponding to "lunchtime on weekdays" and "work mode" can be retrieved based on the mapping relationship between the target time interval and / or the current scene mode and the Gaussian mixture model, or the target Gaussian mixture model corresponding to "lunchtime on weekdays" can be retrieved, or the target Gaussian mixture model corresponding to "work mode" can also be retrieved.

[0119] In the embodiments of this application, Gaussian mixture models can be established in three dimensions: an intraday time period model, a weekly cycle model, and a scene pattern model. The model parameters of the Gaussian mixture models in the three dimensions are as follows: , and The parameter family λ of the Gaussian mixture model in these three dimensions can be characterized as .in, These represent the model parameter clusters for intraday time periods, weekly time periods, and scene pattern models, respectively.

[0120] Model parameter set of intraday timeframe model include , These represent the model parameters of the Gaussian mixture model for the morning, midday, and evening periods, respectively. (This refers to the parameter set of the periodic model.) include , These represent the model parameters of the Gaussian mixture model corresponding to weekdays and weekends, respectively. The model parameter set for the scene pattern model. include , These represent the model parameters of the Gaussian mixture model corresponding to the work mode and the leisure mode, respectively.

[0121] After retrieving the target Gaussian mixture model, the fused behavioral features can be input into the target Gaussian mixture model to obtain the probability values ​​of the fused behavioral features belonging to each Gaussian component in the target Gaussian mixture model. Based on the weights of each Gaussian component in the target Gaussian mixture model, the probability values ​​are weighted to obtain the comprehensive probability value.

[0122] According to the embodiments of this application, different modeling is performed for different periodic time periods and / or scene modes, and corresponding Gaussian mixture models are established from multiple scales. When performing identity authentication, the target Gaussian mixture model that matches the target time interval to which the current authentication timestamp belongs and / or the current scene mode is specifically retrieved for identity authentication, which further improves the accuracy of identity authentication based on Gaussian mixture models.

[0123] In some embodiments, the preset authentication threshold can be a dynamic authentication threshold, which can be determined based on a basic authentication threshold, a risk adjustment term, and a rhythm adjustment term. The risk adjustment term can be determined based on a risk level assessment coefficient and a risk sensitivity coefficient, while the rhythm adjustment term can be determined based on the current authentication time, the target user's historical peak behavior time, and the rhythm cycle.

[0124] For example, the dynamic identity authentication threshold can be determined according to the following formula:

[0125]

[0126] in, For dynamic identity authentication threshold, Basic authentication threshold, For risk sensitivity coefficient, The risk level assessment coefficient, R, has a range of values. , The weighting coefficient for the circadian rhythm term can be adjusted according to the actual situation. T represents the circadian rhythm period, such as a 24-hour rhythm period for an intraday time-sharing model. t represents the peak historical behavior time of the target user, and t represents the current authentication time. As a risk adjustment item, This is a rhythm regulation term.

[0127] According to embodiments of this application, on the one hand, the basic authentication threshold is adjusted through a risk adjustment term. When the risk level and risk sensitivity coefficient are high, increasing the preset identity authentication threshold can effectively reduce the probability of attackers being wrongly allowed to pass, further improving the accuracy of identity authentication based on the Gaussian mixture model. On the other hand, the basic authentication threshold is adjusted through a rhythmic period term. The preset identity authentication threshold is appropriately increased at periodic non-behavioral peak times determined based on the historical peak times of the target user's behavior, reducing misjudgments of the target user's regular behavioral fluctuations and preventing the target user from being unable to log in to their account due to regular behavioral fluctuations, thereby improving the user experience.

[0128] The following also provides specific business scenarios in which the embodiments of this application can be applied, including login authentication, transaction confirmation, and session maintenance.

[0129] In login authentication scenarios, as the user enters their account information, the server, with the user's authorization, can acquire and analyze the user's multimodal behavioral characteristics through the terminal device they are using. By the time the account information is entered, sufficient behavioral data is available to complete the initial identity authentication, significantly reducing explicit authentication steps.

[0130] In transaction confirmation scenarios, when a user to be authenticated performs sensitive operations such as fund transfers, the server can continuously monitor the real-time behavior probability distribution corresponding to the real-time operation behavior of the user to be authenticated and the matching degree (i.e., similarity) with the baseline behavior model corresponding to the account owner (i.e., the target user). If an anomaly is detected, the transaction is immediately interrupted and a secondary verification is requested (i.e., an enhanced verification request is pushed).

[0131] In session maintenance scenarios, where the user to be authenticated maintains the session for an extended period, the server can periodically verify the identity of the current operator to prevent session hijacking attacks. The verification strength can be dynamically adjusted based on time and operational risk.

[0132] Figure 3 The diagram illustrates the authentication process in three stages according to an embodiment of this application.

[0133] During the initialization phase, which involves establishing the Gaussian mixture model and baseline behavior model, sample user actions from the target user can be collected first. Then, the Gaussian mixture model is initialized, meaning it is trained based on the sample samples. Finally, the weights of each feature and the threshold parameters are determined. The threshold parameters include the aforementioned preset authentication thresholds.

[0134] During the authentication phase, multimodal behavior data can be collected in real time first, followed by feature extraction and standardization, namely, obtaining multimodal behavior features in step S210 above, as well as feature preprocessing and normalization as described above. Then, a comprehensive probability value is obtained based on the Gaussian mixture model, and the similarity with the baseline behavior model is calculated. Based on the comprehensive probability value and similarity, the final authentication score is obtained, and identity authentication is performed based on the final authentication score.

[0135] During the model update phase, the relative entropy between the real-time behavior probability distribution and the baseline behavior model can be calculated. Then, an adjustment strategy for updating the model can be determined based on the relative entropy, and the feature weights of the Gaussian mixture model can be adjusted based on the adjustment strategy.

[0136] In some embodiments, the system architecture corresponding to the identity authentication method proposed in this application can consist of three core modules: a behavior feature acquisition module, a behavior feature analysis module, and a dynamic decision-making module. The system can adopt a distributed architecture design, with the front-end device responsible for raw behavior data acquisition and preliminary feature extraction, and the back-end server performing complex feature analysis and authentication decisions. The two interact in real time through an encrypted channel, thereby preventing the leakage of relevant information of the user to be authenticated or the target user, and enabling more secure identity authentication of the user to be authenticated.

[0137] According to embodiments of this application, significant improvements are achieved in multiple aspects, including authentication accuracy, security, user experience, and resource efficiency. Regarding improved authentication accuracy: the fusion of multimodal behavioral features reduces the error rate significantly, far surpassing single-behavioral-feature authentication systems. Regarding enhanced security: dynamic thresholds and continuous authentication mechanisms make it difficult for attackers to maintain a legitimate session even if they obtain partial behavioral features of the target user. Regarding optimized user experience: the authentication process seamlessly integrates into normal operating procedures, shortening the average authentication time. Regarding improved resource efficiency: feature weights can be dynamically adjusted to achieve intelligent feature selection, thereby adjusting the allocation of computational load and minimizing the increase in mobile device power consumption. Regarding adaptability: the adaptive learning mechanism effectively tracks changes in the target user's behavior, and can promptly adjust the Gaussian mixture model and baseline behavioral model when the target user's behavior shows stable drift. This invention combines behavioral biometric technology with modern machine learning algorithms, creatively solving many challenges faced by traditional identity authentication methods and providing a more natural, secure, and continuous identity verification solution for the financial security field.

[0138] Corresponding to the above-described identity authentication method, embodiments of this application also provide an identity authentication device. The following will combine... Figure 4 The device is described.

[0139] Figure 4A schematic block diagram of an identity authentication device according to an embodiment of this application is shown.

[0140] like Figure 4 As shown, the identity authentication device 400 in this embodiment includes a feature conversion module 410, a probability value acquisition module 420, a score generation module 430, and an identity authentication module 440.

[0141] The feature conversion module 410 is used to acquire multimodal behavioral features generated by an authorized user during operations on the client, and convert the multimodal behavioral features into fused behavioral features. In one embodiment, the feature conversion module 410 can be used to perform step S210 described above, which will not be repeated here.

[0142] The probability value acquisition module 420 is used to input the fused behavioral features into a pre-trained Gaussian mixture model, obtain the probability values ​​of the fused behavioral features belonging to each Gaussian component, and perform weighted processing on the probability values ​​based on the weights of each Gaussian component to obtain a comprehensive probability value. The Gaussian mixture model is trained based on the target user's historical multimodal behavioral feature data, and the Gaussian mixture model includes multiple Gaussian components, each of which represents a historical behavioral pattern of the target user. In one embodiment, the probability value acquisition module 420 can be used to execute step S220 described above, which will not be repeated here.

[0143] The score generation module 430 is used to acquire a baseline behavior model, determine the similarity between the fused behavior features and the baseline behavior model, and combine the comprehensive probability value with the similarity to generate a final authentication score. The baseline behavior model is constructed based on the target user's historical multimodal behavior feature data. In one embodiment, the score generation module 430 can be used to execute step S230 described above, which will not be repeated here.

[0144] The identity authentication module 440 is used to determine that the identity authentication of the user to be authenticated is successful if the final authentication score is greater than a preset identity authentication threshold. In one embodiment, the identity authentication module 440 can be used to execute step S240 described above, which will not be repeated here.

[0145] According to embodiments of this application, the aforementioned identity authentication device may further include a model adjustment module, used to acquire a fusion behavior feature sequence of the user to be authenticated within a preset time window, and construct a real-time behavior probability distribution based on the fusion behavior feature sequence; calculate the relative entropy between the real-time behavior probability distribution and the baseline probability distribution corresponding to the baseline behavior model; and, when the user to be authenticated passes identity authentication or the current risk level meets preset update conditions, determine an adjustment strategy for the Gaussian mixture model and / or the baseline behavior model based on the relationship between the relative entropy and at least one preset entropy threshold, and adjust the Gaussian mixture model and / or the baseline behavior model accordingly.

[0146] According to embodiments of this application, the adjustment strategy for a Gaussian mixture model may include at least one of the following: feature weight adjustment, incremental model update, and model reconstruction.

[0147] According to embodiments of this application, the entropy threshold may include a first entropy threshold and a second entropy threshold, wherein the first entropy threshold is less than the second entropy threshold; the aforementioned model adjustment module may specifically be used to adjust the feature weights of the Gaussian mixture model based on the relative entropy when the relative entropy is less than the first entropy threshold; to incrementally update the Gaussian mixture model based on the fusion behavior feature sequence when the relative entropy is greater than or equal to the first entropy threshold and less than the second entropy threshold; and to reconstruct the Gaussian mixture model using the expectation-maximization algorithm based on the fusion behavior feature sequence when the relative entropy is greater than or equal to the second entropy threshold.

[0148] According to an embodiment of this application, the aforementioned model adjustment module can be specifically used to determine the risk level of real-time operation behavior when it is determined that the real-time operation behavior of the user to be authenticated has experienced stable drift; when the risk level is the first risk level, the fused behavior feature sequence is used as the model update sample set of the shadow model corresponding to the Gaussian mixture model, wherein the first risk level is used to characterize that the risk of the real-time operation behavior is lower than a preset risk threshold; the shadow model is trained based on the model update sample set, and the trained shadow model is cross-validated a preset number of times; when the cross-validation pass rate is greater than a preset pass rate threshold, the model parameters of the shadow model are fused with the model parameters of the Gaussian mixture model.

[0149] According to an embodiment of this application, the above-mentioned identity authentication device further includes an enhanced verification push module, which is used to push an enhanced verification request to the user to be authenticated when the risk level is the second risk level, and to stop updating the Gaussian mixture model based on the fusion behavior feature sequence. The second risk level is used to characterize that the risk of real-time operation behavior is greater than or equal to a preset risk threshold. The enhanced verification request includes at least one of the following: static password authentication, dynamic token authentication, and biometric authentication.

[0150] According to an embodiment of this application, the probability value acquisition module 420 can be specifically used to acquire the current authentication timestamp and / or the current scene mode, and determine the target time interval to which the current authentication timestamp belongs, wherein the target time interval is any one of a plurality of pre-divided periodic time intervals; according to the preset mapping relationship between the periodic time interval and / or the current scene mode and the Gaussian mixture model, retrieve the target Gaussian mixture model that matches the target time interval and / or the current scene mode; input the fused behavioral features into the target Gaussian mixture model to obtain the probability values ​​of the fused behavioral features belonging to each Gaussian component in the target Gaussian mixture model; and perform weighted processing on the probability values ​​based on the weights of each Gaussian component in the target Gaussian mixture model to obtain a comprehensive probability value.

[0151] According to an embodiment of this application, the preset identity authentication threshold can be a dynamic identity authentication threshold, which can be determined based on a basic authentication threshold, a risk adjustment item, and a rhythm adjustment item. The risk adjustment item can be determined based on a risk level assessment coefficient and a risk sensitivity coefficient, and the rhythm adjustment item can be determined based on the current authentication time, the target user's historical peak behavior time, and the rhythm cycle.

[0152] According to embodiments of this application, any multiple modules among the feature conversion module 410, probability value acquisition module 420, score generation module 430, and identity authentication module 440 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this application, at least one of the feature conversion module 410, probability value acquisition module 420, score generation module 430, and identity authentication module 440 can be at least partially implemented as hardware circuits, such as field-programmable gate arrays, programmable logic arrays, systems-on-a-chip, systems-on-a-substrate, systems-on-package, application-specific integrated circuits, or other reasonable means of integrating or packaging circuits, or implemented in hardware or firmware, or in any one of software, hardware, and firmware implementations, or in a suitable combination of any of these. Alternatively, at least one of the feature conversion module 410, probability value acquisition module 420, score generation module 430, and identity authentication module 440 may be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0153] Figure 5 A block diagram schematically illustrates an electronic device suitable for implementing an authentication method according to an embodiment of this application.

[0154] like Figure 5As shown, an electronic device 500 according to an embodiment of this application includes a processor 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory 502 or a program loaded from a storage portion 508 into a random access memory 503. The processor 501 may include, for example, a general-purpose microprocessor, an instruction set processor and / or an associated chipset and / or a dedicated microprocessor. The processor 501 may also include onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for executing different steps of the method flow according to an embodiment of this application.

[0155] Random access memory 503 stores various programs and data required for the operation of electronic device 500. Processor 501, read-only memory 502, and random access memory 503 are interconnected via bus 504. Processor 501 executes various steps of the method flow according to embodiments of this application by executing programs in read-only memory 502 and / or random access memory 503. It should be noted that the programs may also be stored in one or more memories other than read-only memory 502 and random access memory 503. Processor 501 may also execute various steps of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0156] According to embodiments of this application, the electronic device 500 may further include an input / output interface 505, which is also connected to a bus 504. The electronic device 500 may also include one or more of the following components connected to the input / output interface 505: an input section 506 including a keyboard, mouse, etc.; an output section 507 including a cathode ray tube, liquid crystal display, etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card, such as a local area network card, modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the input / output interface 505 as needed. A removable medium 511, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 510 as needed so that computer programs read from it can be installed into the storage section 508 as needed.

[0157] Embodiments of this application also provide a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0158] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination thereof. In embodiments of this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include the read-only memory 502, and / or random access memory 503, and / or one or more memories other than read-only memory 502 and random access memory 503 described above.

[0159] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods provided in the embodiments of this application.

[0160] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 509, and / or installed from a removable medium 511. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0161] In embodiments of this application, the computer program can be downloaded and installed from a network via communication section 509, and / or installed from removable medium 511. When the computer program is executed by processor 501, it performs the functions defined in the system of this application embodiment. According to embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0162] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0163] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0164] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. An identity authentication method, characterized in that, The method includes: The system acquires multimodal behavioral features generated by authorized users during their operations on the client and converts these multimodal behavioral features into fused behavioral features. The fused behavioral features are input into a pre-trained Gaussian mixture model to obtain the probability values ​​of the fused behavioral features belonging to each Gaussian component. The probability values ​​are then weighted based on the weights of each Gaussian component to obtain a comprehensive probability value. The Gaussian mixture model is trained based on the historical multimodal behavioral feature data of the target user. The Gaussian mixture model includes multiple Gaussian components, and each Gaussian component represents a historical behavioral pattern of the target user. A baseline behavior model is obtained, the similarity between the fused behavior features and the baseline behavior model is determined, and the final authentication score is generated by combining the comprehensive probability value with the similarity. The baseline behavior model is constructed based on the historical multimodal behavior feature data of the target user. If the final authentication score is greater than the preset identity authentication threshold, the identity authentication of the user to be authenticated is deemed successful.

2. The method according to claim 1, characterized in that, The method further includes: Obtain the fused behavioral feature sequence of the user to be authenticated within a preset time window, and construct a real-time behavioral probability distribution based on the fused behavioral feature sequence; Calculate the relative entropy between the real-time behavior probability distribution and the baseline probability distribution corresponding to the baseline behavior model; If the identity of the user to be authenticated is successfully verified or the current risk level meets the preset update conditions, an adjustment strategy for the Gaussian mixture model and / or the baseline behavior model is determined based on the relationship between the relative entropy and at least one preset entropy threshold, and the Gaussian mixture model and / or the baseline behavior model are adjusted accordingly.

3. The method according to claim 2, characterized in that, The adjustment strategies for the Gaussian mixture model include at least one of the following: feature weight adjustment, incremental model update, and model reconstruction.

4. The method according to claim 3, characterized in that, The entropy threshold includes a first entropy threshold and a second entropy threshold, wherein the first entropy threshold is smaller than the second entropy threshold; the step of determining the adjustment strategy for the Gaussian mixture model and adjusting the Gaussian mixture model based on the relationship between the relative entropy and at least one preset entropy threshold includes: If the relative entropy is less than a first entropy threshold, the feature weights of the Gaussian mixture model are adjusted based on the relative entropy. When the relative entropy is greater than or equal to the first entropy threshold and less than the second entropy threshold, the Gaussian mixture model is incrementally updated based on the fusion behavior feature sequence. If the relative entropy is greater than or equal to the second entropy threshold, the Gaussian mixture model is reconstructed based on the fusion behavior feature sequence using the expectation-maximization algorithm.

5. The method according to claim 4, characterized in that, The incremental update of the Gaussian mixture model based on the fused behavioral feature sequence includes: If the real-time operation behavior of the user to be authenticated is found to have a stable drift, the risk level of the real-time operation behavior is determined. When the risk level is the first risk level, the fusion behavior feature sequence is used as the model update sample set of the shadow model corresponding to the Gaussian mixture model, wherein the first risk level is used to characterize that the risk of the real-time operation behavior is lower than a preset risk threshold. The shadow model is trained based on the model update sample set, and the trained shadow model is subjected to a preset number of cross-validations. If the pass rate of the cross-validation is greater than a preset pass rate threshold, the model parameters of the shadow model are fused with the model parameters of the Gaussian mixture model.

6. The method according to claim 5, characterized in that, The method further includes: When the risk level is the second risk level, an enhanced verification request is pushed to the user to be authenticated, and the updating of the Gaussian mixture model based on the fusion behavior feature sequence is stopped. The second risk level is used to characterize that the risk of the real-time operation behavior is greater than or equal to a preset risk threshold. The enhanced verification request includes at least one of the following: static password authentication, dynamic token authentication, and biometric authentication.

7. The method according to claim 1, characterized in that, The process involves inputting the fused behavioral features into a pre-trained Gaussian mixture model to obtain the probability values ​​of the fused behavioral features belonging to each Gaussian component, and then weighting these probability values ​​based on the weights of each Gaussian component to obtain a comprehensive probability value. This includes: Obtain the current authentication timestamp and / or the current scene mode, and determine the target time interval to which the current authentication timestamp belongs, wherein the target time interval is any one of a plurality of pre-divided periodic time intervals; Based on the preset periodic time interval and / or the mapping relationship between the current scene mode and the Gaussian mixture model, retrieve the target Gaussian mixture model that matches the target time interval and / or the current scene mode; The fusion behavior feature is input into the target Gaussian mixture model to obtain the probability value of the fusion behavior feature belonging to each Gaussian component in the target Gaussian mixture model; The probability values ​​are weighted based on the weights of each Gaussian component in the target Gaussian mixture model to obtain the comprehensive probability value.

8. The method according to claim 7, characterized in that, The preset identity authentication threshold is a dynamic identity authentication threshold, which is determined based on the basic authentication threshold, risk adjustment item, and rhythm adjustment item. The risk adjustment item is determined based on the risk level assessment coefficient and the risk sensitivity coefficient, while the rhythm adjustment item is determined based on the current authentication time, the target user's historical peak behavior time, and the rhythm cycle.

9. An identity authentication device, characterized in that, The device includes: The feature conversion module is used to acquire multimodal behavioral features generated by an authorized user during operations on the client, and convert the multimodal behavioral features into fused behavioral features. The probability value acquisition module is used to input the fused behavioral features into a pre-trained Gaussian mixture model to obtain the probability values ​​of the fused behavioral features belonging to each Gaussian component, and to perform weighted processing on the probability values ​​based on the weights of each Gaussian component to obtain a comprehensive probability value. The Gaussian mixture model is trained based on the historical multimodal behavioral feature data of the target user. The Gaussian mixture model includes multiple Gaussian components, and each Gaussian component represents a historical behavioral pattern of the target user. A score generation module is used to acquire a baseline behavior model, determine the similarity between the fused behavior features and the baseline behavior model, and combine the comprehensive probability value with the similarity to generate a final authentication score. The baseline behavior model is constructed based on the target user's historical multimodal behavior feature data. The identity authentication module is used to determine that the identity authentication of the user to be authenticated is successful if the final authentication score is greater than a preset identity authentication threshold.

10. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 8.

12. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 8.

Images