Captcha security pushing method and system based on multi-task learning

Abstract

The application belongs to the technical field of Internet security and identity verification, and discloses a multi-task learning verification code security pushing method and system. By acquiring the network address and request timestamp of the current verification code request, the historical sequence of the geographic coordinate longitude and latitude, the device fingerprint hash value and the time zone information within the preset time window of the target account is extracted; the time sequence offset feature is calculated and is processed and spliced into an input sequence through a time step sliding window; the preset long short-term memory network encodes the account time sequence behavior mode and outputs a hidden layer state tensor; the abnormal behavior quantization index is generated by quantizing the short-time network and the device change intensity, the cross-time zone abnormal device switching attack is identified by combining the device consistency weighted verification, and the verification code pushing strategy is adjusted. The application solves the problem that the existing scheme only relies on instantaneous features and cannot associate time sequence dispersed abnormal signals, and improves the attack identification accuracy and protection reliability of the verification code pushing.

Description

Technical Field

[0001] This application belongs to the field of Internet security and identity verification technology, specifically a multi-task learning method and system for secure CAPTCHA push. Background Technology

[0002] As a fundamental means of internet identity verification, CAPTCHAs bear the important responsibility of protecting user account security and preventing malicious attacks. With the widespread adoption of internet services and the continuous evolution of attack methods by black market actors, the security threats faced by the CAPTCHA delivery process are becoming increasingly complex. Attackers use automated scripts and distributed proxy networks to launch attacks such as credential stuffing and brute-force attacks, posing a severe challenge to account security and platform protection systems. How to accurately identify abnormal requests while ensuring a smooth experience for legitimate users has become a core issue that urgently needs to be addressed in CAPTCHA security systems.

[0003] Current CAPTCHA security solutions generally employ real-time feature extraction as a protection strategy, where the system independently analyzes the access characteristics at the current moment for each request to determine risk. This approach has significant drawbacks: attackers can exhibit rule-compliant behavior in a single detection by dispersing request times, frequently changing network addresses, or simulating normal device fingerprints. When the same account initiates multiple CAPTCHA requests at different times, although the immediate characteristics of each request may be within the security threshold, the accumulated behavioral trajectory often reveals abnormal patterns. Existing systems lack the ability to continuously track historical account interaction data, making it impossible to correlate scattered abnormal signals over time to form a complete risk profile and capture behavioral trends across time scales.

[0004] In summary, existing technologies are unable to solve the core problems of low recognition rate of covert and persistent attacks, insufficient correlation of time-series abnormal signals, and poor positioning accuracy of attacks when switching devices across time zones. They are also unable to meet the security protection needs of CAPTCHAs in complex Internet scenarios. There is an urgent need for an intelligent CAPTCHA security push solution based on time-series behavior profiles. Summary of the Invention

[0005] To address the above issues, this application provides a multi-task learning-based method and system for secure CAPTCHA push, thereby improving the attack identification accuracy and protection reliability of CAPTCHA push.

[0006] To achieve the above objectives, the technical solution adopted in this application is as follows: Firstly, this application provides a multi-task learning-based method for securely pushing CAPTCHAs, including: Obtain the network address and request timestamp of the current verification code request. Based on the request timestamp, extract the geographic coordinate latitude and longitude sequence, device fingerprint hash value sequence and time zone information sequence corresponding to the historical requests of the target account from a preset time window. The offset of adjacent geographic coordinates is calculated based on the latitude and longitude sequence of the geographic coordinates, and the time zone interval difference corresponding to the time zone switching in the time zone information sequence is statistically analyzed in combination with the request timestamp to obtain a set of time sequence behavior features; The time-series behavioral feature set is sliced ​​using a time-step sliding window to form an input sequence of a preset length; The input sequence is temporally encoded using a pre-defined long short-term memory network, and the hidden layer state tensor is output. Based on the device fingerprint hash value sequence, extract the network address segment jump frequency statistics and hardware identifier change times within the anomaly quantification statistical interval from the hidden layer state tensor, and obtain the abnormal behavior quantification index through cross-product operation; If the abnormal behavior quantification index exceeds the preset cross-time zone device switching risk threshold, the browser fingerprint information entropy value and hardware feature code of the current request are extracted, and the average matching similarity between the hardware feature code and the historical normal hardware feature code is calculated. The weighted combination of the average matching similarity and the browser fingerprint information entropy value is calculated. If the weighted combination result is lower than the device consistency threshold, it is determined to be an abnormal device switching attack across time zones, and the verification code push strategy is adjusted according to the determination result of the attack.

[0007] This application also provides a multi-task learning-based CAPTCHA secure push system, including: The time-series data acquisition module is used to obtain the network address and request timestamp of the current verification code request. Based on the request timestamp, it extracts the geographic coordinate latitude and longitude sequence, device fingerprint hash value sequence and time zone information sequence corresponding to the historical requests of the target account from a preset time window. The temporal feature calculation module is used to calculate the offset of adjacent geographical coordinates based on the latitude and longitude sequence of the geographical coordinates, and combine the request timestamp to count the time zone interval difference corresponding to the time zone switching in the time zone information sequence, so as to obtain a set of temporal behavior features; The input sequence construction module is used to slice the temporal behavior feature set using a time step sliding window to form an input sequence of a preset length; The temporal pattern encoding module is used to perform temporal encoding on the input sequence through a preset long short-term memory network and output the hidden layer state tensor. The abnormal indicator quantification module is used to extract the network address segment jump frequency statistics and hardware identifier change times within the abnormal quantification statistical interval from the hidden layer state tensor based on the device fingerprint hash value sequence, and obtain the abnormal behavior quantification indicator through cross-product operation. The device consistency verification module is used to extract the browser fingerprint information entropy value and hardware feature code of the current request if the abnormal behavior quantification index exceeds the preset cross-time zone device switching risk threshold, and to calculate the average matching similarity between the hardware feature code and the historical normal hardware feature code. The risk assessment and interception module is used to calculate the weighted combination result of the average matching similarity and the browser fingerprint information entropy value. If the weighted combination result is lower than the device consistency threshold, it is determined to be an abnormal device switching attack across time zones, and the verification code push strategy is adjusted according to the attack assessment result.

[0008] Compared with the prior art, this application has the following beneficial effects: (1) By extracting multi-dimensional historical time series data of accounts through a preset time window and constructing a set of time series behavioral features, the abnormal signals scattered in the time dimension can be correlated and analyzed, effectively identifying the continuous covert attacks of attackers who make scattered requests and bypass detection one by one, breaking through the detection bottleneck of traditional solutions that rely only on the instantaneous features of a single request, and greatly improving the detection rate of low-speed credential stuffing and distributed proxy attacks.

[0009] (2) Long short-term memory network is used to encode the temporal behavior sequence. Effective historical information is adaptively filtered through gating mechanism to accurately mine the deep behavioral patterns of account location jump and time zone switching. Compared with traditional statistical methods, it can identify more complex abnormal feature combinations, and the risk profile is more comprehensive and the abnormality is more distinguishable.

[0010] (3) The two-layer judgment logic of initial screening of abnormal indicators and fine-tuning of device consistency is adopted. First, the majority of normal requests are quickly filtered out by quantitative indicators, and then the weighted verification of hardware features and browser fingerprints is combined for accurate review. While improving the attack identification rate, the probability of false judgment is effectively reduced, taking into account both the protection strength and the user experience of legitimate users.

[0011] (4) The sliding window mechanism is used to continuously update the account behavior sequence, which can dynamically adapt to the normal changes in account behavior patterns. The core framework of the solution is universal, and only the threshold parameters need to be adjusted to adapt to various verification code protection scenarios such as e-commerce, finance, and government affairs. The feature dimensions can be flexibly expanded, and the protection system is robust. Attached Figure Description

[0012] Figure 1 This is a flowchart illustrating the multi-task learning verification code secure push method provided in an embodiment of this application.

[0013] Figure 2 This is a schematic diagram of the structure of a multi-task learning verification code security push system provided in an embodiment of this application. Detailed Implementation

[0014] To enable those skilled in the art to better understand the technical solution, the present application will be described in detail below with reference to the embodiments. The description in this section is only exemplary and explanatory, and should not be used to limit the scope of protection of the present application in any way.

[0015] Reference Figure 1 This application provides a multi-task learning-based method for securely pushing CAPTCHAs, including: S11: Obtain the network address and request timestamp of the current verification code request, and extract the geographic coordinate latitude and longitude sequence, device fingerprint hash value sequence and time zone information sequence corresponding to the historical requests of the target account from the preset time window based on the request timestamp; S12: Calculate the offset of adjacent geographic coordinates based on the geographic coordinate latitude and longitude sequence, and combine the request timestamp to count the time zone interval difference corresponding to the time zone switching in the time zone information sequence, to obtain a set of time sequence behavior features; S13: The time-series behavioral feature set is sliced ​​using a time-step sliding window to form an input sequence of a preset length; S14: The input sequence is temporally encoded using a preset long short-term memory network, and the hidden layer state tensor is output. S15: Based on the device fingerprint hash value sequence, extract the network address segment jump frequency statistics and hardware identifier change times within the abnormal quantification statistics interval from the hidden layer state tensor, and obtain the abnormal behavior quantification index through cross-product operation. S16: If the abnormal behavior quantification index exceeds the preset cross-time zone device switching risk threshold, then extract the browser fingerprint information entropy value and hardware feature code of the current request, and calculate the average matching similarity between the hardware feature code and the historical normal hardware feature code. S17: Calculate the weighted combination result of the average matching similarity and the browser fingerprint information entropy value. If the weighted combination result is lower than the device consistency threshold, it is determined to be an abnormal device switching attack across time zones, and the verification code push strategy is adjusted according to the determination result of the attack.

[0016] This embodiment discloses a multi-task learning-based CAPTCHA secure push method, applicable to account login and identity verification scenarios of integrated internet service platforms. It serves the construction of the platform's information security protection system, accurately identifying and intercepting CAPTCHA brute-force attacks involving cross-timezone abnormal device switching. It is adaptable to various CAPTCHA triggering scenarios, including account login, password retrieval, and sensitive operation verification. This embodiment constructs a test set based on real platform business data, selecting tens of thousands of CAPTCHA request records from 30 consecutive days, covering tens of thousands of normal user accounts and labeled attack request samples. Attack types include three typical scenarios: proxy address switching brute-force attacks, device-forged batch requests, and cross-regional distributed attacks. All threshold parameters are calibrated based on the statistical distribution of labeled samples, ensuring that the judgment criteria have a statistical basis.

[0017] In step S11, the network address and request timestamp of the current verification code request are obtained. Based on the request timestamp, the geographical coordinate latitude and longitude sequence, device fingerprint hash value sequence and time zone information sequence corresponding to the historical requests of the target account are extracted from the preset time window.

[0018] In one implementation, the basic data collection for the current request is first completed through the access gateway layer. When a user triggers a verification code request, the access gateway parses the header and body of the HTTP (Hypertext Transfer Protocol) request message, extracts the network address (which is a source address identifier based on IP (Internet Protocol) and is used to locate the network access location of the request; the corresponding actual geographical location can be obtained through mapping using a geodatabase), and simultaneously extracts the request timestamp (a high-precision time stamp marking the moment the verification code request was initiated, with millisecond-level precision, used to unify the time base of all time-series data and ensure the time alignment accuracy of subsequent feature calculations). The gateway also parses the target account identifier from the request parameters, which serves as the unique primary key for subsequent historical data retrieval.

[0019] After completing the current request data collection, historical data is extracted within a preset time window. This preset time window is a pre-defined time range used to capture historical account behavior data, serving as the data boundary for time-series behavior analysis. Its length is determined based on platform historical attack data statistics: statistics show that the vast majority of persistent CAPTCHA attacks are concentrated within 7 days of the initial request. A 7-day window covers the complete cycle of most attacks without introducing excessive historical noise that could decrease computational efficiency or increase the false positive rate, achieving an optimal balance between detection coverage and computational efficiency. Using the current request timestamp as the window endpoint and the target account identifier as the retrieval primary key, all historical CAPTCHA request records of the target account within this time window are retrieved from the preset time-series database. All records are initially arranged in ascending order of timestamp.

[0020] For each historical request record, field parsing and feature extraction are performed to generate three types of time-series sequences. The first type is a geographic coordinate latitude and longitude sequence, which is a set of latitude and longitude data corresponding to the geographical locations of each request, arranged in chronological order. This reflects the geographical migration trajectory of account access. It is generated by parsing the network address of each record using a high-precision IP geodatabase to obtain the latitude and longitude of the corresponding location, accurate to the city level, and then arranging them in ascending order of timestamps to form a sequence. The second type is a device fingerprint hash value sequence, which is a set of hash values ​​of the device fingerprints corresponding to each request, arranged in chronological order. This is used to identify changes in the accessing device. It is generated by performing a message digest hash operation on the device hardware identifier carried in the request to generate a fixed-length hash string. The hardware identifier of the same device corresponds to a unique hash value, and the probability of collision between hash values ​​of different devices is extremely low, which can serve as a reliable basis for determining device uniqueness. All hash values ​​are arranged in chronological order to form a sequence. The third category is time zone information sequence, which is a set of information on the time zone of each request corresponding to the location, arranged in chronological order. It reflects the time zone switching pattern of account access. It is generated by matching the time zone of the request location according to the administrative region corresponding to the geographical coordinates, representing it as an integer time zone offset, and arranging it in chronological order to form a sequence.

[0021] The three types of sequences use a unified timestamp index to ensure strict alignment of the time dimension, providing a unified time benchmark for subsequent time series feature calculations. If the target account has no historical request records within the preset time window, it is determined to be a first request and directly enters the regular verification code push process without performing subsequent time series risk assessments, thus avoiding misjudgments due to the lack of historical references.

[0022] In step S12, the offset of adjacent geographic coordinates is calculated based on the geographic coordinate latitude and longitude sequence, and the time zone interval difference corresponding to the time zone switching in the time zone information sequence is statistically analyzed in combination with the request timestamp to obtain a time sequence behavior feature set.

[0023] In one implementation, this step sequentially calculates two core temporal features: geographic offset and time zone switching, ultimately integrating them into a structured feature set. First, the geographic coordinate offset is calculated. This offset refers to the great circle distance between the corresponding geographic locations of two adjacent requests, used to quantify the variation in the account's access location; a larger value indicates a greater geographical span between two adjacent requests. The calculation uses a spherical distance formula, which accurately calculates the great circle distance between two points on the Earth's surface, avoiding high-latitude errors caused by planar distance calculations, and is suitable for long-distance offset calculations across cities and time zones.

[0024] The formula for calculating spherical distance is as follows: In the formula: d is the great circle distance between the two points, in kilometers; R is the average radius of the Earth, which is 6,371 meters; φ1 and φ2 are the latitudes of the two points, in radians; λ1 and λ2 are the longitudes of the two points, in radians.

[0025] By sequentially calculating the spherical distance of each pair of adjacent requests in the sequence, a sequence of geographic coordinate offsets corresponding one-to-one with time points is obtained. The geographic offsets of normal users usually conform to daily travel patterns, with cross-city offsets accompanied by reasonable time intervals; while attack behavior often involves large geographic jumps in a short period of time, with the offsets not matching the time intervals. This feature can effectively distinguish between normal travel and cross-regional access by proxy address spoofing.

[0026] Next, the time zone interval difference corresponding to time zone switching is calculated. This time zone interval difference refers to the time interval between two adjacent time zone switching events, used to measure the frequency of time zone switching. The shorter the interval, the more frequent the time zone switching, and the higher the risk of anomalies. Specifically, the time zone information sequence is traversed, and the time zone offset values ​​of adjacent records are compared sequentially. If the values ​​are different, it is marked as a time zone switch, and the time node of the switch is recorded. All time zone switching time nodes are extracted in chronological order, and the time interval difference between two adjacent time zone switches is calculated by combining the timestamps of the corresponding historical requests, in hours. If there is no time zone switching within the time window, the time zone interval difference is the total duration of the window, corresponding to the normal state of no switching.

[0027] After the two types of features are calculated, they are aligned point by point according to a unified timestamp index. The time zone interval difference corresponding to time points where no time zone switch has occurred is recorded as zero, and the time-series behavioral feature set is integrated to form a time-series aligned feature set. The time-series behavioral feature set is a structured feature set that integrates geographical offset and time zone switch features. It serves as the input basis for subsequent time-series modeling. Each time node in the set corresponds to a complete two-dimensional feature value, which fully describes the behavioral offset features of the account at the corresponding time.

[0028] In step S13, the time-series behavioral feature set is sliced ​​using a time-step sliding window to form an input sequence of a preset length.

[0029] In one implementation, this step constructs a standardized input sequence through sliding window slicing and feature concatenation. Slicing is a preprocessing step before concatenating a fixed-length sequence. First, a preset time step and a preset sliding step are set. Using the current requested time as the window endpoint, sliding window slicing is performed on the temporal behavioral feature set, resulting in a preset number of time step feature subsets arranged in ascending order of time. Each time step feature subset refers to a set of temporal feature data corresponding to a fixed duration, obtained from a single sliding window, and serves as the computational carrier for single-step statistical features. The time step sliding window is a processing mechanism that segments the temporal feature set according to a fixed time granularity and sliding step, used to convert variable-length temporal data into fixed-length sequence fragments to adapt to the input format requirements of neural network models. In this embodiment, the basic time step is set to 1 hour, the sliding step is set to 15 minutes, and a single input sequence contains 12 consecutive time steps, that is, it covers 12 hours of continuous behavioral data. This length was determined through comparative experiments and has the best overall performance in terms of detection accuracy and computational efficiency: if the window is too short, it cannot capture the complete behavioral pattern and the detection accuracy will decrease; if the window is too long, it will introduce redundant historical data, increase the amount of computation, and easily cause misjudgment.

[0030] For each time step feature subset, the month-on-month change rate of geographic coordinate offsets and the periodic cumulative sum of time zone interval differences within that subset are calculated to generate single-step statistical features for the corresponding time step. These single-step statistical features refer to the aggregated features obtained after statistical calculations of the original time-series features within a single time step, used to compress time-series information and unify input dimensions. Specifically, the month-on-month change rate of geographic coordinate offsets is the ratio of the sum of all geographic offsets in the current time period to the sum of offsets in the previous time period, reflecting the changing trend of geographic jump intensity; the periodic cumulative sum of time zone interval differences is the accumulated value of the interval differences corresponding to all time zone switches occurring within that time period, reflecting the density of time zone switches.

[0031] The single-step statistical features corresponding to each time step are concatenated according to a preset feature order to generate a one-dimensional feature vector with consistent dimensions. All one-dimensional feature vectors are then arranged sequentially in chronological order and normalized to form an input sequence of a preset length. This input sequence is standardized time-series data conforming to the input format requirements of Long Short-Term Memory (LSTM) networks, after sliding window slicing and feature concatenation. It contains a fixed number of time steps and corresponding feature vectors. The normalization process uses a max-min normalization method, mapping all feature values ​​to a standard range of 0 to 1. This eliminates the influence of differences in feature dimensions on subsequent neural network calculations, ensuring balanced weights for each dimension and preventing features with large values ​​from dominating the calculation process.

[0032] In step S14, the input sequence is temporally encoded using a preset long short-term memory network to output the hidden layer state tensor.

[0033] In one implementation, this step uses an LSTM (Long Short-Term Memory) network to perform temporal encoding. The LSTM network is a recurrent neural network with a gating mechanism, which can effectively capture temporal dependencies in long sequences, avoiding the gradient vanishing problem during long sequence training. It is very suitable for processing temporally related sequence data such as account behavior. This embodiment uses a single-layer unidirectional LSTM network with a hidden layer dimension of 64. This dimension was determined through parameter tuning to fully encode the temporal dependencies of two-dimensional features, while avoiding the risk of overfitting and a surge in computation caused by excessively high dimensionality.

[0034] The network model undergoes supervised training based on a massive amount of normal user behavior samples and labeled attack samples. The training and validation sets are divided in an 8:2 ratio. The loss function is binary cross-entropy, and the optimizer uses the adaptive moment estimation algorithm. The initial learning rate is set to 0.001, and the training epochs are set to 50. An early stopping mechanism is employed to prevent overfitting. After training, the model achieves a high level of accuracy in identifying abnormal temporal patterns. After training, the weight parameters are fixed and deployed in the behavior analysis engine layer for temporal encoding inference of real-time requests.

[0035] The specific encoding execution process consists of four steps, which completely correspond to the three-gating structure logic of the network: The first step is input gate processing. The current step input of the input sequence and the hidden state from the previous time step are input to the input gate of the Long Short-Term Memory (LSTM) network. The retention weights for the current input are calculated, and candidate state vectors are generated based on the current step input. These candidate state vectors are then weighted using the retention weights to obtain the state information to be updated. The retention weights are calculated using the activation function and the input gate weight matrix, and their values ​​range from 0 to 1, controlling the proportion of the current input information retained. The candidate state vectors contain the information to be updated from the current input.

[0036] The second step is the forgetting gate filtering. The forgetting coefficient, output by the forgetting gate of the Long Short-Term Memory (LSTM) network, is used to perform element-wise weighted filtering of the previous time-series unit states, discarding redundant historical information irrelevant to the current behavioral pattern, thus obtaining the filtered historical unit states. The presence of the forgetting gate enables the model to adaptively retain key historical trajectories while ignoring distant and irrelevant data, accurately characterizing recent behavioral patterns.

[0037] The third step is unit state update. The filtered historical unit states are overlaid and merged with the weighted state information to be updated, thus updating the cumulative value of the unit state at the current moment. The unit state carries all valid behavioral information from the beginning of the sequence to the current moment and is the core memory carrier of the network.

[0038] The fourth step is output gate generation. Output control coefficients are generated through the output gates of the Long Short-Term Memory network, and the updated current unit state is mapped to generate the hidden layer state tensor corresponding to each time step.

[0039] After all time steps of the input sequence undergo the above processing, the final output is a hidden layer state tensor. This hidden layer state tensor is a high-order feature tensor output by the Long Short-Term Memory network after encoding the input sequence. The vector corresponding to each time step encodes historical behavioral information up to and including that moment, representing the account's temporal behavioral pattern. Each time step of this tensor corresponds to a 64-dimensional feature vector, encoding the target account's geographical migration patterns and time zone switching characteristics at the corresponding time point. It contains deep temporal behavioral pattern information and has a stronger anomaly detection capability compared to the original statistical features.

[0040] In step S15, based on the device fingerprint hash value sequence, the network address segment jump frequency statistics and hardware identifier change count within the abnormal quantification statistical interval are extracted from the hidden layer state tensor, and the abnormal behavior quantification index is obtained through cross-product operation.

[0041] In one implementation, firstly, based on the change time sequence nodes of the device fingerprint hash value sequence, the time step range corresponding to the anomaly quantification statistical interval is defined, and the time sequence feature segment corresponding to the time step range is extracted from the hidden layer state tensor. The anomaly quantification statistical interval refers to a pre-set time range used to statistically analyze the intensity of short-term behavior changes to calculate the anomaly behavior quantification index. In this embodiment, the duration is set to 2 hours. This duration is determined based on the typical duration of short-term attacks: cross-time zone device switching attacks usually launch requests in a concentrated manner within a few hours. The 2-hour interval can fully cover the high-frequency phase of the attack without introducing excessively long historical data to dilute the anomaly intensity. After verification by multiple sets of comparative experiments, this interval length has the highest anomaly discrimination.

[0042] The extracted temporal feature fragments are input into a fully connected mapping layer for feature parsing and dimension mapping, outputting the network address segment hop frequency statistics and the number of hardware identifier changes, respectively. The fully connected mapping layer is used to map high-order abstract temporal features into quantifiable statistical indicators, realizing the conversion from hidden layer features to business statistical values. The network address segment hop frequency statistics refer to the number of times the network segment to which the request source network address belongs changes within a specified time range. In this embodiment, the determination rule is that the same first three digits of the network address are considered as the same segment, and different digits are considered as one hop. This indicator can effectively reflect the frequency of proxy address switching and is one of the core features for identifying distributed proxy attacks. The number of hardware identifier changes refers to the number of times the device fingerprint is changed within the corresponding time period, reflecting the intensity of changes in the device environment.

[0043] A cross-product operation is performed on the statistical value of network address segment hopping frequency and the number of hardware identifier changes, and the result is determined as a quantitative indicator of abnormal behavior. This quantitative indicator of abnormal behavior, constructed by the cross-product operation, characterizes the coupling strength of two-dimensional synchronous anomalies: when only one dimension is abnormal, the increase in the product value is limited; when both dimensions experience high-frequency changes simultaneously, the product value increases significantly, thus accurately reflecting the composite risk characteristics of network address and hardware device synchronous switching in cross-time zone device switching attacks. This indicator, as a dimensionless anomaly score, is only used to measure the coupling strength of two-dimensional synchronous anomalies; its value reflects the degree of attack risk.

[0044] The formula for calculating the quantitative indicators of abnormal behavior is as follows: In the formula: I is the abnormal behavior quantification index; f is the network address segment jump frequency statistics within the abnormal quantification statistical interval; d is the number of hardware identifier changes within the abnormal quantification statistical interval.

[0045] This indicator uses a cross-product calculation method, which can amplify the risk weight of simultaneous anomalies in two dimensions: when only address hopping is frequent and the device remains fixed, it may be a normal fluctuation in the user's mobile network, and the risk is relatively low; when only device changes and the address is fixed, it may be that the user is changing terminal devices, and the risk is also limited; however, when address hopping and device changes occur at the same high frequency, the product will increase significantly, accurately corresponding to the typical characteristics of cross-time zone device switching attacks, effectively improving the anomaly differentiation, and has a stronger anomaly identification capability compared to the simple summation calculation method.

[0046] The preset cross-timezone device switching risk threshold is based on the statistical distribution of historical labeled samples on the platform: the distribution of this indicator within the corresponding time period of normal users is statistically analyzed, and the 99th percentile is used as the threshold. This covers the vast majority of normal user behavior, keeping the false positive rate below 1%, while detecting more than 95% of cross-timezone device switching attacks, achieving an optimal balance between false positive and detection rates. When the abnormal behavior quantitative indicator exceeds this threshold, it is judged as a high-risk request in the initial screening and enters the next fine-grained verification stage; if it does not exceed the threshold, it is judged as a normal request and a regular CAPTCHA is pushed. The initial screening mechanism can quickly filter out the vast majority of normal requests, performing complex fine-grained verification only on a small number of high-risk requests, greatly improving overall processing efficiency while ensuring detection accuracy.

[0047] In step S16, if the abnormal behavior quantification index exceeds the preset cross-time zone device switching risk threshold, the browser fingerprint information entropy value and hardware feature code of the current request are extracted, and the average matching similarity between the hardware feature code and the historical normal hardware feature code is calculated.

[0048] In one implementation, this step initiates a device consistency verification process for high-risk requests initially screened. This process verifies the authenticity of the device identity from two dimensions: browser fingerprint and underlying hardware, to eliminate false positives in normal scenarios. During the verification process, the extraction and calculation of two types of core device features are performed in parallel: The first type is the browser fingerprint information entropy value. This value is a quantitative index of information entropy calculated based on the multi-dimensional feature distribution of the browser, used to measure the uniqueness and stability of the browser fingerprint. Its calculation process includes four steps: attribute collection, discretization encoding, entropy value calculation, and weighted summation.

[0049] In the attribute collection step, multi-dimensional browser attributes corresponding to the current request are collected, including eight dimensions of attribute data: user agent string, browser plugin list, system font list, screen resolution, time zone offset, HTTP_ACCEPT header, canvas fingerprint hash value, and WebGL (Web Graphics Library) fingerprint hash value.

[0050] In the discretization encoding step, standardized discretization processing is performed on attributes of each dimension: for categorical attributes (such as user agent string, plugin name, font name), one-hot encoding is used to map each attribute value to a binary feature vector; for numerical attributes (such as screen width, screen height, time zone offset), equal-width binning is used to divide continuous values ​​into several discrete intervals, each interval corresponding to an encoded value; for hash attributes (such as canvas fingerprint, WebGL fingerprint), their hash string is directly used as the discrete identifier.

[0051] In the entropy calculation step, based on the historical request records of the target account within a preset time window, the distribution frequency of attribute values ​​for each dimension is statistically analyzed, and the information entropy value of each attribute is calculated according to the information entropy formula, which is as follows: In the formula: H j K represents the information entropy value of the j-th dimension attribute; j p represents the number of distinct values ​​of the j-th dimension attribute in the historical samples. jk The information entropy is the frequency of the k-th value for the j-th dimension attribute, which is the number of times that value appears in historical samples divided by the total number of historical samples. The unit of information entropy is bits. The higher the entropy value, the more dispersed the distribution of that dimension attribute in historical samples and the higher its discriminative power; the lower the entropy value, the more concentrated the values ​​of that dimension attribute and the lower its discriminative power.

[0052] In the weighted aggregation step, weight coefficients are assigned to each of the eight dimensions. These weight coefficients are directly calculated as the ratio of the entropy value of each dimension attribute to the sum of the entropy values ​​of all dimensions; that is, dimensions with higher attribute discriminative power receive higher weights. The discretized encoded values ​​of each dimension attribute are then weighted and summed with their corresponding weights to obtain the browser fingerprint entropy value. The calculation formula is as follows: In the formula: H is the browser fingerprint information entropy value; w j H represents the weight coefficient of the j-th dimension attribute. j Let be the information entropy value of the j-th dimension attribute.

[0053] The browser fingerprint information entropy of a normal real device is usually at a high level, indicating that its various attributes have high distinguishability in historical distribution; while the information entropy value of a batch of forged script fingerprints is generally low because the values ​​of its various attributes are highly concentrated and have low distinguishability. This feature can effectively distinguish real browsers from automated scripts.

[0054] The second type is the hardware signature code, which is a fixed-length signature string generated from the underlying hardware attribute information of the current requesting terminal through standardized encoding and hash operation. It is tamper-resistant and used for unique device identity verification. Its generation process includes three steps: hardware attribute acquisition, standardized encoding, and hash operation.

[0055] In the hardware attribute collection step, the underlying hardware attributes of the current requesting terminal are extracted, including hardware attribute data in five dimensions: processor model string, graphics card model string, BIOS (Basic Input Output System) version string, hard drive serial number string, and motherboard serial number string. These attributes are collected through the system information interface reported by the terminal device. The collection method differs across operating system platforms: Windows platforms collect data through the Windows Management Instrumentation interface, macOS platforms collect data through the system configuration interface, and Linux platforms collect data through system file nodes.

[0056] In the standardized encoding process, the five collected hardware attribute strings are concatenated sequentially in a preset order, with each attribute string connected by a vertical bar separator to form the original feature string. The standardized encoding rules are as follows: each attribute string undergoes preprocessing operations including removing leading and trailing whitespace characters, compressing multiple consecutive whitespace characters into a single space, and converting them to lowercase characters; the five preprocessed attribute strings are then concatenated in the order of "processor model|graphics card model|BIOS version|hard drive serial number|motherboard serial number," with adjacent attributes connected by vertical bars separators.

[0057] In the hash operation step, the original feature string formed after standardization and encoding is subjected to SHA-256 (SecureHash Algorithm 256-bit) cryptographic hash operation to generate a fixed-length 256-bit hash value. This hash value is output as a 64-bit hexadecimal string as the final hardware signature. The SHA-256 algorithm is collision-resistant and avalanche-resistant; even small changes in the input data will lead to significant differences in the output hash value. This ensures that different hardware configurations generate different hardware signatures, and that the original hardware attribute information cannot be deduced from the hardware signature, thereby protecting user device privacy.

[0058] After feature extraction, a reference sample set is constructed by selecting hardware signature codes corresponding to the target account's historical normal requests. These historical normal requests refer to CAPTCHA requests from the target account that, within a preset time window, did not trigger any abnormal interception based on historical risk assessment and were marked as legitimate access. Hardware signature codes extracted based on these requests can serve as a reference benchmark for device identity verification. The reference sample set is a set of samples composed of hardware signature codes corresponding to historical normal requests, used for similarity comparison with the hardware signature codes of the current request. The matching similarity between the current hardware signature code and all samples in the reference sample set is calculated, and the average matching similarity is obtained by taking the average value. In this embodiment, the hardware signature codes of the target account's 10 most recent normal CAPTCHA requests are selected as reference samples. The sample selection follows the principle of proximity, which can better adapt to the normal changes in users changing devices.

[0059] The formula for calculating the average matching similarity is as follows: In the formula: sim is the average matching similarity; n is the number of historical hardware feature codes; v c This is the vectorized form of the current hardware feature code; v i It is the vectorized form of the i-th historical hardware feature code.

[0060] The calculation process first numerically encodes the attributes of each dimension of the hardware signature, converting them into fixed-length feature vectors. Then, the cosine similarity between the vectors is calculated. Finally, the average of all historical samples is taken as the final average matching similarity. This algorithm is insensitive to the dimensions of the feature dimensions and can accurately measure the directional similarity between two feature vectors, making it very suitable for similarity comparison of multi-dimensional discrete features such as device fingerprints. The average matching similarity ranges from 0 to 1; a higher value indicates stronger device consistency and a higher probability of belonging to a legitimate user; a lower value indicates greater device differences and a higher probability of a counterfeit device.

[0061] In step S17, the weighted combination result of the average matching similarity and the browser fingerprint information entropy value is calculated. If the weighted combination result is lower than the device consistency threshold, it is determined to be an abnormal device switching attack across time zones, and the verification code push strategy is adjusted according to the determination result of the attack. In one implementation, this step uses a multi-dimensional weighted device consistency determination to ultimately confirm the attack behavior and execute interception, minimizing the probability of false positives for legitimate users and ensuring user experience. First, preset weight coefficients are configured for the average matching similarity and the browser fingerprint entropy value. The two are then weighted and summed according to these weight coefficients to obtain a comprehensive device consistency score, which serves as the weighted combination result. This weighted combination result, the comprehensive device consistency score, is a comprehensive judgment value obtained by weighting multi-dimensional device features according to preset weights. The comprehensive device consistency score is a comprehensive evaluation value obtained by weighting the average matching similarity and the browser fingerprint entropy value according to preset weights. A higher score indicates stronger device authenticity and consistency, while a lower score indicates a higher probability of device forgery.

[0062] The formula for calculating the overall equipment consistency score is as follows: Where: S is the overall device consistency score; sim is the average matching similarity; H is the entropy value of the current browser fingerprint information; H max is the maximum information entropy of the browser fingerprint; w1 and w2 are the weight coefficients of the corresponding dimensions.

[0063] The weighting coefficients were determined through feature importance analysis of the labeled samples. The hardware signature was weighted at 0.7, while the browser fingerprint entropy was weighted at 0.3. The hardware signature had a higher weight because the underlying hardware features are much more difficult to forge than the surface browser fingerprints, thus possessing stronger device differentiation capabilities. The preset device consistency threshold was determined by the optimal equilibrium point of the receiver operating characteristic curve of the labeled samples, and was set to 0.6. If the value was below this threshold, the probability of the device being forged exceeded 90%, indicating that the device was suspected of being forged, and the corresponding request was a cross-timezone abnormal device switching attack.

[0064] The adjusted verification code push strategy is implemented by generating interception instructions, which trigger the following three levels of handling: Level 1: Reject the current verification code push request, return a system busy message, and do not send verification code content to the attacker; Level 2: Mark the account as a high-risk account, and forcibly use enhanced verification methods such as sliders and clicks for all requests within the next 24 hours, further raising the attack threshold; Level 3: Add the attack source network address and device fingerprint to the platform blacklist, restricting the frequency of verification code requests within the next 7 days, reducing the possibility of subsequent attacks. This three-level handling mechanism together constructs a comprehensive information security protection loop, forming a complete chain from single request interception to long-term risk management, effectively curbing the continued occurrence of similar attacks.

[0065] To quantify and verify the protective effect of this method, this embodiment establishes a simulated test environment, selecting 50,000 normal user accounts and 5,000 labeled attack samples for comparative testing. The test duration covers a complete business cycle of 7 consecutive days. This experiment selects two mainstream protection schemes as controls to verify the detection capabilities of each scheme against cross-time zone device switching attacks: Scheme A is a traditional instantaneous feature detection scheme, which judges risk based solely on a single feature of the current request; Scheme B is the method proposed in this application. This experiment sets four core evaluation indicators: attack detection rate, false positive rate, average response latency, and attack interception success rate.

[0066] After 7 consecutive days of testing, the statistical results of various indicators are as follows: the attack detection rate of Solution A is 42.6%, the false alarm rate is 8.3%, the average response latency is 12 milliseconds, and the attack interception success rate is 38.7%. This solution relies only on instantaneous features and cannot correlate with time-dispersed abnormal signals. It has extremely weak ability to identify distributed, low-frequency covert attacks and is prone to misjudging occasional logins from different locations by normal users as attacks, resulting in a high false alarm rate.

[0067] Solution B, i.e., the solution proposed in this application, achieves an attack detection rate of 94.2%, a false positive rate of 1.2%, an average response latency of 28 milliseconds, and an attack interception success rate of 92.5%. Test results demonstrate that this solution effectively enhances information security protection capabilities in the CAPTCHA process, significantly reducing the space for attack behavior while ensuring a positive user experience. Its overall protection performance is significantly superior to traditional solutions.

[0068] To further verify the adaptability of the solution, this experiment also tested the detection performance under different attack intensities, setting up three attack scenarios: low intensity (10 requests per day), medium intensity (50 requests per day), and high intensity (200 requests per day). The test results showed that the solution achieved a detection rate of 87.3% for low-intensity attacks, 95.8% for medium intensity, and 98.6% for high intensity. The detection rate gradually increased with increasing attack intensity, consistent with the risk patterns of real-world attack scenarios. In contrast, traditional solutions achieved a detection rate of less than 20% under low-intensity attacks, making it difficult to detect covert, low-speed credential stuffing attacks.

[0069] Furthermore, the impact of different time window lengths on detection performance was tested, with three window periods of 3 days, 7 days, and 14 days. The results showed that the 7-day period had the best overall performance: the 3-day window lacked sufficient historical data, failing to fully cover some long-term attacks, resulting in a 4.5 percentage point decrease in the detection rate; the 14-day window incorporated too much historical data, and the natural changes in normal user behavior increased the false positive rate by 1.8 percentage points. The 7-day window length achieves the best balance between detection coverage and false positive rate, making it suitable for long-term stable internet business scenarios.

[0070] The experimental results show that the proposed solution is significantly better than traditional solutions in terms of attack detection rate, false alarm rate, and interception success rate, while maintaining extremely low response latency. It can effectively solve the core problems of low identification rate of covert and persistent attacks and insufficient correlation of time-series abnormal signals in existing technologies, and has clear technical advantages and practical application value.

[0071] This embodiment only describes the account login verification scenario of a comprehensive internet platform. This solution can also be extended to other internet scenarios requiring identity verification, such as e-commerce platforms, financial services, and government systems, covering mainstream CAPTCHA attack scenarios. For different scenarios, adaptation can be completed simply by collecting the corresponding scenario's normal business historical data and recalibrating the threshold parameters, without modifying the core algorithm framework. It possesses strong scenario versatility and solution scalability.

[0072] Meanwhile, the feature dimensions of this solution can be expanded according to actual needs, adding more behavioral feature dimensions such as request frequency, operation path, and input habits, further improving the accuracy of time-series behavior profiling and the fine granularity of anomaly identification, adapting to more complex business security scenarios. The model supports regular automatic updates, adapting to the slow changes in account behavior patterns and ensuring long-term detection effectiveness.

[0073] In summary, this application achieves efficient and accurate identification of cross-time zone abnormal device switching attacks through a complete technical chain of multi-dimensional time-series data collection, sliding window sequence construction, deep network time-series coding, and two-layer risk assessment. It effectively makes up for the shortcomings of traditional CAPTCHA protection in detecting time-series behavior and provides reliable technical support for Internet account security and CAPTCHA push protection.

[0074] refer to Figure 2 The second embodiment of this application provides a multi-task learning-based CAPTCHA secure push system, including: The time-series data acquisition module 20 is used to obtain the network address and request timestamp of the current verification code request, and extract the geographic coordinate latitude and longitude sequence, device fingerprint hash value sequence and time zone information sequence corresponding to the historical requests of the target account from a preset time window based on the request timestamp. The temporal feature calculation module 21 is used to calculate the offset of adjacent geographical coordinates based on the latitude and longitude sequence of the geographical coordinates, and combine the request timestamp to count the time zone interval difference corresponding to the time zone switching in the time zone information sequence, so as to obtain a set of temporal behavior features; The input sequence construction module 22 is used to slice the temporal behavior feature set using a time step sliding window to form an input sequence of a preset length; The temporal pattern encoding module 23 is used to perform temporal encoding on the input sequence through a preset long short-term memory network and output the hidden layer state tensor. The abnormal indicator quantification module 24 is used to extract the network address segment jump frequency statistics and hardware identifier change times within the abnormal quantification statistical interval from the hidden layer state tensor based on the device fingerprint hash value sequence, and obtain the abnormal behavior quantification index through cross-product operation. The device consistency verification module 25 is used to extract the browser fingerprint information entropy value and hardware feature code of the current request if the abnormal behavior quantification index exceeds the preset cross-time zone device switching risk threshold, and calculate the average matching similarity between the hardware feature code and the historical normal hardware feature code. The risk assessment and interception module 26 is used to calculate the weighted combination result of the average matching similarity and the browser fingerprint information entropy value. If the weighted combination result is lower than the device consistency threshold, it is determined to be an abnormal device switching attack across time zones, and the verification code push strategy is adjusted according to the attack assessment result.

[0075] It should be noted that, in this document, the terms "comprising," "including," and any other variations are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Specific examples have been used in this document to illustrate the principles and implementation methods of the technical solutions of this application. The above examples are only for the purpose of helping to understand the methods and core ideas of this application. The above descriptions are merely preferred embodiments of this application. It should be pointed out that, due to the limitations of written expression and the objective existence of infinite specific structures, those skilled in the art can make several improvements, modifications, or changes without departing from the principles of this application, and can also combine the above technical features in an appropriate manner; these improvements, modifications, changes, or combinations, or the direct application of the concept and technical solutions of this application to other situations without modification, should all be considered within the scope of protection of this application.

Claims

1. A multi-task learning method for secure CAPTCHA push, characterized in that, include: Obtain the network address and request timestamp of the current verification code request. Based on the request timestamp, extract the geographic coordinate latitude and longitude sequence, device fingerprint hash value sequence and time zone information sequence corresponding to the historical requests of the target account from a preset time window. The offset of adjacent geographic coordinates is calculated based on the latitude and longitude sequence of the geographic coordinates, and the time zone interval difference corresponding to the time zone switching in the time zone information sequence is statistically analyzed in combination with the request timestamp to obtain a set of time sequence behavior features; The time-series behavioral feature set is sliced ​​using a time-step sliding window to form an input sequence of a preset length; The input sequence is temporally encoded using a pre-defined long short-term memory network, and the hidden layer state tensor is output. Based on the device fingerprint hash value sequence, extract the network address segment jump frequency statistics and hardware identifier change times within the anomaly quantification statistical interval from the hidden layer state tensor, and obtain the abnormal behavior quantification index through cross-product operation; If the abnormal behavior quantification index exceeds the preset cross-time zone device switching risk threshold, the browser fingerprint information entropy value and hardware feature code of the current request are extracted, and the average matching similarity between the hardware feature code and the historical normal hardware feature code is calculated. The weighted combination of the average matching similarity and the browser fingerprint information entropy value is calculated. If the weighted combination result is lower than the device consistency threshold, it is determined to be an abnormal device switching attack across time zones, and the verification code push strategy is adjusted according to the determination result of the attack.

2. The multi-task learning-based CAPTCHA secure push method according to claim 1, characterized in that, The step of obtaining the network address and request timestamp of the current verification code request, and extracting the geographic coordinate latitude and longitude sequence, device fingerprint hash value sequence, and time zone information sequence corresponding to the historical requests of the target account from a preset time window based on the request timestamp, includes: The CAPTCHA access gateway parses the header and request body of the current CAPTCHA request, and extracts the network address and request timestamp based on the header and request body. Within a preset time window, using the request timestamp as the window endpoint and the target account identifier as the retrieval key, historical verification code request records of the target account are extracted from a preset time-series database. For each historical verification code request record, the fields are parsed to extract the geographical coordinates (latitude and longitude) obtained from the network address parsing, the device fingerprint hash value generated by hash operation, and the time zone information corresponding to the request location. After sorting them in ascending order by timestamp, a sequence of geographical coordinates (latitude and longitude), a sequence of device fingerprint hash value, and a sequence of time zone information are generated.

3. The multi-task learning-based CAPTCHA secure push method according to claim 1, characterized in that, The step involves calculating the offset of adjacent geographic coordinates based on the latitude and longitude sequence, and combining this with the request timestamp to statistically analyze the time zone interval difference corresponding to time zone switching in the time zone information sequence, thereby obtaining a set of temporal behavior features, including: Based on the geographic coordinate latitude and longitude sequence, the distance between two adjacent requests on the Earth's surface great circle is calculated as the geographic coordinate offset. Traverse the time zone information sequence, compare the time zone offset values ​​of adjacent requests, record the time nodes when all time zones switch, and calculate the time zone interval difference between two adjacent time zone switches by combining the request timestamp. The geographic coordinate offset and time zone interval difference are aligned point by point according to a unified timestamp index, and integrated to form a time-series aligned time-series behavioral feature set.

4. The multi-task learning-based CAPTCHA secure push method according to claim 1, characterized in that, The step of slicing the temporal behavior feature set using a time-step sliding window to form an input sequence of a preset length includes: Set a preset time step and a preset sliding step, and use the current request time as the window endpoint to perform sliding window slicing on the time-series behavior feature set to obtain multiple time step feature subsets arranged in ascending order of time; Calculate the month-on-month change rate of geographic coordinate offset and the periodic cumulative sum of time zone interval difference for each of the time step feature subsets to generate single-step statistical features; The single-step statistical features corresponding to each time step are concatenated according to a preset feature order to generate a feature vector with consistent dimensions. The feature vectors are arranged in chronological order and then normalized to form an input sequence of a preset length.

5. The multi-task learning-based secure CAPTCHA push method according to claim 1, characterized in that, The step of temporally encoding the input sequence using a preset long short-term memory network and outputting a hidden layer state tensor includes: The input sequence is input into a preset long short-term memory network. The retention weight of the current input is calculated based on the current step input and the hidden state at the previous time step through the input gate of the long short-term memory network. At the same time, a candidate state vector is generated based on the current step input. The candidate state vector is weighted by the retention weight to obtain the state information to be updated. The forgetting gate of the Long Short-Term Memory Network is used to perform element-wise weighted filtering of the previous unit state based on the current step input and the forgetting coefficient of the hidden state output at the previous step, discarding redundant historical information that is irrelevant to the current behavior pattern, and obtaining the filtered historical unit state. The filtered historical unit status is overlaid and merged with the weighted status information to be updated to complete the update of the cumulative value of the unit status at the current moment; The output gate generates output control coefficients based on the current step input and the hidden state of the previous time step. The updated current time step unit state is then mapped to generate the hidden layer state tensor corresponding to each time step.

6. The multi-task learning-based CAPTCHA secure push method according to claim 1, characterized in that, The step involves extracting the network address segment jump frequency statistics and hardware identifier change count within the anomaly quantification statistical interval from the hidden layer state tensor based on the device fingerprint hash value sequence, and obtaining the anomaly behavior quantification index through cross-product operation, including: Based on the change time sequence nodes of the device fingerprint hash value sequence, the time step range corresponding to the anomaly quantization statistical interval is defined, and the time sequence feature fragment corresponding to the time step range is extracted from the hidden layer state tensor. The time-series feature segments are input into a fully connected mapping layer for feature parsing and dimension mapping, and the statistical values ​​of network address segment jump frequency and the number of hardware identifier changes are output respectively. The frequency of network address segment jumps is cross-multiplied with the number of hardware identifier changes, and the result is determined as a quantitative indicator of abnormal behavior.

7. The multi-task learning-based CAPTCHA secure push method according to claim 1, characterized in that, If the abnormal behavior quantification index exceeds a preset cross-time zone device switching risk threshold, then the browser fingerprint information entropy value and hardware feature code of the current request are extracted, and the average matching similarity between the hardware feature code and historical normal hardware feature codes is calculated, including: If the abnormal behavior quantification index exceeds the preset cross-time zone device handover risk threshold, the device consistency verification process will be initiated. In the verification process, the browser multi-dimensional attributes corresponding to the current request are collected, and the browser fingerprint information entropy value is calculated based on the browser multi-dimensional attributes. At the same time, the underlying hardware attributes of the current requesting terminal are extracted, and hardware feature codes with anti-tampering properties are generated through combination operations. Select the hardware signature codes corresponding to the historical normal requests of the target account to construct a reference sample set, calculate the matching similarity between the current hardware signature code and all samples in the reference sample set, and take the average value to obtain the average matching similarity.

8. The multi-task learning-based CAPTCHA secure push method according to claim 1, characterized in that, The weighted combination of the average matching similarity and the browser fingerprint entropy value is calculated. If the weighted combination result is lower than the device consistency threshold, it is determined to be a cross-time zone abnormal device switching attack, and the verification code push strategy is adjusted according to the attack determination result, including: Preset weighting coefficients are configured for the average matching similarity and the browser fingerprint information entropy value, respectively. The average matching similarity and the browser fingerprint information entropy value are then weighted and summed according to the weighting coefficients to obtain the device consistency comprehensive score. The overall device consistency score is compared with a preset device consistency threshold. If the overall score is lower than the device consistency threshold, the current verification code request is determined to be an abnormal device switching attack across time zones, and the attack determination result is obtained. Adjust the CAPTCHA push strategy based on the attack determination results.

9. A multi-task learning CAPTCHA secure push system, characterized in that, include: The time-series data acquisition module is used to obtain the network address and request timestamp of the current verification code request. Based on the request timestamp, it extracts the geographic coordinate latitude and longitude sequence, device fingerprint hash value sequence and time zone information sequence corresponding to the historical requests of the target account from a preset time window. The temporal feature calculation module is used to calculate the offset of adjacent geographical coordinates based on the latitude and longitude sequence of the geographical coordinates, and combine the request timestamp to count the time zone interval difference corresponding to the time zone switching in the time zone information sequence, so as to obtain a set of temporal behavior features; The input sequence construction module is used to slice the temporal behavior feature set using a time step sliding window to form an input sequence of a preset length; The temporal pattern encoding module is used to perform temporal encoding on the input sequence through a preset long short-term memory network and output the hidden layer state tensor. The abnormal indicator quantification module is used to extract the network address segment jump frequency statistics and hardware identifier change times within the abnormal quantification statistical interval from the hidden layer state tensor based on the device fingerprint hash value sequence, and obtain the abnormal behavior quantification indicator through cross-product operation. The device consistency verification module is used to extract the browser fingerprint information entropy value and hardware feature code of the current request if the abnormal behavior quantification index exceeds the preset cross-time zone device switching risk threshold, and to calculate the average matching similarity between the hardware feature code and the historical normal hardware feature code. The risk assessment and interception module is used to calculate the weighted combination result of the average matching similarity and the browser fingerprint information entropy value. If the weighted combination result is lower than the device consistency threshold, it is determined to be an abnormal device switching attack across time zones, and the verification code push strategy is adjusted according to the attack assessment result.

Images