WO2016049983A1 - User keyboard key-pressing behavior mode modeling and analysis system, and identity recognition method thereof - Google Patents

Abstract

A user keyboard key-pressing behavior mode modeling and analysis system, and identity recognition method thereof. The identity recognition method comprises: conducting data analysis according to a history of key-pressing information of password inputting when a user logs into an account within a period of time and establishing a corresponding hidden Markov probabilistic model, and conducting a model calculation with respect to new data to be measured, in order to identify a user identity. The system consists of a user data acquisition module, a data cleaning module, a model training module, and a user identity authentication module. The present invention utilizes a user input behavior mode without requiring additional hardware support, and records a typing time characteristic while the user inputs a username and password, making the process of implementing an authentication method more simple and feasible. By acquiring a user typing time interval sequence and mining user-specific typing behavior mode, the real identity of a user can be identified, thus improving the accuracy of user identity authentication.

Description

User keyboard key behavior pattern modeling and analysis system and its identification method Technical field

The invention relates to e-commerce identity authentication.

Background technique

With the development of e-commerce, the insecurities are also exposed, and more and more security risks exist in the e-commerce website, giving the criminals a chance. Traditional e-commerce websites use user names and password pairs to identify users. This authentication method is based on the assumption that only real users know their user names and passwords. Once an illegal user knows the user's information, the authentication method is used. No longer valid. How to effectively identify the true identity of users has become an area of interest in the development of e-commerce.

Summary of the invention

Everyone has their own unique behavioral habits, as well as the keyboard input behavior. Personal behaviors are also difficult to be imitated and stolen by others. The authentication method established on this basis is only the user name and password. The correct method is more effective.

The present invention is directed to the case where a conventional username and password pair is stolen by a criminal. Existing methods and means of authentication cannot prevent criminals from stealing legitimate accounts of others for personal gain.

To this end, in order to achieve the object of the invention, the technical solution given by the invention is:

Method principle: According to the historical key information of the user entering the password when the account is logged in for a period of time, the data is analyzed and the corresponding hidden Markov probability model is established, and the model data is calculated for the new data to be tested to identify the user identity. The method steps are:

Step 1, user data collection

Responsible for collecting the time interval sequence in which the user enters their username and password. In the HTML webpage, JS is used to collect time data of the user's user name and password. The collected data is the timestamp of each character that the user types in the user name and password and the system timestamp of the popup, and the original data is stored in the database.

Step 2, data cleaning

Responsible for preprocessing the collected data. For a user, its fixed password, the number of data items per record is fixed, and the data items whose data items do not match the specified length are rejected.

Step 3, Model Training

Responsible for analyzing and modeling each user's typing patterns. The selected modeling feature is the button delay, which is the time to press the pop-up (which can also be modeled using the interval between each button).

Step 4, User Identity Authentication

Responsible for model calculation of new data to be tested to identify the user's identity. The data typed by the user is collected, and according to the model built by the training module, it is determined whether the user is a legitimate user. Different keyboards have different damping coefficients, which may cause differences in the time characteristics of the user's pressing on different keyboards. The present invention provides an algorithm for eliminating keyboard damping. Eliminate the keyboard damping algorithm:

(41) According to the pressing and popping time of each button, the difference between the two is calculated, and the delay of each button is obtained.

(42) According to the expectation of each button delay in the hidden Markov model, the difference between the current sequence button delay and the model value is calculated, and a set of difference sequences for each button delay is obtained.

(43) Calculate the variance and expectation of the difference sequence.

(44) When the variance is less than the threshold, the observation of the current sequence button delay is subtracted from the expectation of the difference sequence, and the calibrated keyboard button delay is obtained.

For the typing of an unknown user, the forward selection algorithm is used to calculate the trusted value of the user, and it is determined whether the trusted value of the user is higher than a set threshold to determine whether it is a legitimate user.

A user keyboard key behavior pattern modeling and analysis system is characterized in that it comprises a user data acquisition module, a data cleaning module, a model training module and a user identity authentication module.

The user data collection module is responsible for collecting the time interval sequence in which the user inputs his user name and password. In the HTML webpage, JS is used to collect time data of the user's user name and password. The collected data is the timestamp of each character that the user types in the user name and password and the system timestamp of the popup, and the original data is stored in the database.

The data cleaning module is responsible for preprocessing the collected data. For a user, its fixed password, the number of data items per record is fixed, and the data items whose data items do not match the specified length are rejected.

The model training module is responsible for analyzing and modeling the typing patterns of each user. The selected modeling feature is The button delay is the time the pop-up is pressed (the interval between each button can also be used to model).

The user identity authentication module is responsible for performing model calculation on the new data to be tested to identify the identity of the user. The data typed by the user is collected, and according to the model built by the training module, it is determined whether the user is a legitimate user.

The invention utilizes the user's input behavior mode without additional hardware support, and records the typing time feature while the user inputs his user name and password. This authentication method is more convenient and feasible in the implementation process. By collecting the user's typed time interval sequence, each user's unique typing behavior pattern is mined to identify the user's true identity, and the user's identity authentication is more accurate. Its innovations and benefits are reflected in:

1. Eliminate the same user's operation on different keyboards, and the impact of different keyboard damping on identity authentication results.

2. Eliminate the impact of multi-person use of the same account on identity authentication results.

3. For the length and complexity of the password, a hierarchical modeling approach is adopted.

4. It is portable, easy to configure, and does not require third-party software support.

DRAWINGS

Figure 1 User typed a behavioral pattern mining system.

Figure 2 converts the password into a category code.

Figure 3 is an authentication flow chart.

Figure 4 requires calibration of the keyboard damping factor.

Figure 5 does not require calibration of the keyboard damping factor.

detailed description

The user types the behavior pattern mining system as shown in Figure 1.

Data collection module: JS is used to collect the time data of the user's user name and password in the HTML webpage. The collected data is the timestamp of each character that the user types in the user name and password and the system timestamp of the popup. The original data is stored. Into the database. Since the user is familiar with the user name and password from the stranger to the familiar process, the typing mode will also change over time. We record the most recent month of typing data as the user's training data.

The data format is shown in the following table:

Key sequence Press time Bouncing time 1 1972 2088 2 2486 2557 3 2666 2715 4 2777 2778

Among them, the time of pressing and popping is the system time stamp when the action is completed.

Data cleaning module: Clean dirty data.

Some of the data collected by JS does not conform to the rules, and the data is processed or eliminated. For a user, its fixed password, the number of data items per record is fixed, and the data items whose data items do not match the specified length are rejected. It is assumed that greater than 5000ms means that the user blocks the entire password input process due to external factors, and the abnormal value is compensated by linear interpolation.

E-commerce websites generally have the phenomenon that multiple people share an account. In particular, family groups use one account to use e-commerce websites. For a multi-person shared account, each legal member has its own unique typing behavior pattern, and using the typing behavior alone can determine that there is a large false positive rate. Multi-user data is clustered by K-means to eliminate abnormal data and distinguish whether the data source is from different users.

Calculate the variance of the data items processed by all dirty data in an account. When the variance is greater than a specific threshold, K-means clustering is performed on the account. K-means clustering is to use the mean of all data samples in each clustering subset as the central vector of the cluster. The iterative process is used to divide the data set into different categories, so that the criterion function for evaluating clustering performance reaches the most. Excellent, making each cluster generated compact and independent between classes.

K-means algorithm description:

1, randomly pick k points as the initial center vector, and k is the number of subclasses to be clustered;

2, assigning other samples to the nearest central vector to form disjoint clusters;

3. Use the center vector of each cluster as the new center;

4. Repeat steps 2 and 3 until the algorithm converges.

The invention uses the variance value as a criterion function to cluster the accounts whose variance is greater than the threshold, until the variance is less than a certain threshold, the cluster ends.

Model training module:

1. The selected modeling feature is the button delay, that is, the pop-up time (which can also be modeled by the interval between each button).

A_i为某个字符在第i个样本中的按键间隔值；k为训练样本数。2. For a user, the interval between the input of a particular character is assumed to be subject to a normal distribution process. The collected training data is used to establish a normal distribution model that each character obeys in its own password input process. Since the parameters in the normal distribution process cannot be accurately obtained, the maximum likelihood estimation method is used to calculate the parameter values of the normal distribution obeyed by each character from the training model. among them,

A _i is the key interval value of a character in the ith sample; k is the number of training samples.

3. For the length of the password, the complexity is modeled separately.

Password length and complexity have a large impact on the accuracy of the authentication. The longer and more complex the password, the more difficult it is for the user's typing behavior pattern to be imitated by others, and the higher the accuracy of the authentication. Different authentication models are established according to different password lengths and complexity, so that the accuracy of system authentication is improved.

For short passwords or simple passwords, the distinction between illegal and legitimate users is not high, and the selection of authentication models and parameter settings are more stringent; the user characteristics of long passwords or complex passwords are more obvious, in order to reduce the system's The error rejection rate selects an authentication model and parameter settings that are more suitable for long passwords.

The user's password characters are divided into four types of records, namely: number (N), uppercase letter (U), lowercase letter (D), special character (S), which converts the user's password into a category code for password complexity. Calculation. The converted form is shown in Figure 2.

To calculate the complexity of the user's password, the complexity of the defined password is the sum of the character complexity and the jump complexity. The calculation rules are as follows:

1 character complexity. The complexity of each character is defined as: N is 0, D is 1, U is 2, and S is 4.

2 jump complexity. For the complexity of one character to the next, if the next character is different from the current character's category code, the complexity is increased by one.

The overall complexity of a password is the sum of its character complexity and jump complexity.

4. Parameter optimization through multiple iterations.

User identity authentication module: collects data typed by the user, and determines whether the user is a legitimate user according to a model built by the training module. For the typing of an unknown user, the forward selection algorithm is used to calculate the trusted value of the user, and it is determined whether the trusted value of the user is higher than a set threshold to determine whether it is a legitimate user. The certification process is shown in Figure 3.

Due to the different types of keyboards, the damping coefficients of different keyboards are different, and the time characteristics of the user pressing may be different on different keyboards. The present invention provides an algorithm for eliminating keyboard damping. Eliminate the keyboard damping algorithm:

1, according to the press and pop-up time of each button, calculate the difference between the two, get the delay of each button.

2. According to the expectation of each button delay in the hidden Markov model, the difference between the current sequence button delay and the model value is calculated, and a set of difference sequences for each button delay is obtained.

3. Calculate the variance and expectation of the difference sequence.

4. When the variance is less than the threshold, the observation of the current sequence button delay is subtracted from the expectation of the difference sequence, and the calibrated keyboard button delay is obtained.

A schematic diagram of eliminating the keyboard damping algorithm is shown in FIG. 4 and FIG. 5.

Claims (3)

An identification method for modeling and analyzing user keyboard key behavior patterns, characterized in that data analysis is performed according to historical key information of a password input by a user during a period of time, and a corresponding hidden Markov probability model is established, and The new data to be tested is modeled to identify the user; the method steps are: Step 1, user data collection Responsible for collecting the time interval sequence in which the user inputs his user name and password, and uses JS to collect time data of the user's user name and password in the HTML webpage, and the collected data is the timestamp and bullet of each character in which the user types the user name and password. The system timestamp, the original data is stored in the database; Step 2, data cleaning For a user, its fixed password, the number of data items per record is fixed, and the data items whose data items do not match the specified length are eliminated; Step 3, Model Training Responsible for analyzing and modeling each user's typing mode. The selected modeling features are the button delay, ie, the pop-up time, or the interval between each button is used to model; Step 4, User Identity Authentication Responsible for the model calculation of the new data to be tested; collecting the data typed by the user, and determining whether the user is a legitimate user according to the model built by the training module; when the damping coefficients of different keyboards are different, the time characteristics of the user pressing are different. There may be differences on the keyboard, eliminating the keyboard damping algorithm: (41) Calculate the difference between the two buttons according to the pressing and pop-up time of each button, and obtain the delay of each button; (42) According to the expectation of each button delay in the hidden Markov model, the difference between the current sequence button delay and the model value is calculated, and a set of difference sequences for each button delay is obtained; (43) calculating the variance and expectation of the difference sequence; (44) When the variance is less than the threshold, the observation of the current sequence button delay is subtracted from the expectation of the difference sequence, and the calibrated keyboard button delay is obtained. The method for identifying and analyzing a user keyboard key behavior pattern according to claim 1, wherein, for the typing of an unknown user, the forward selection algorithm is used to calculate the trusted value of the user, and whether the trusted value of the user is high is determined. Determine whether it is a legitimate user at the set threshold. A user keyboard key behavior mode modeling and analysis system, characterized in that: a user data acquisition module, a data cleaning module, a model training module, and a user identity authentication module, The user data collection module is responsible for collecting the time interval sequence in which the user inputs the user name and password; using JS to collect the time data of the user's user name and password in the HTML webpage, and the collected data is the pressing of each character of the user into the user name and password. Timestamp and pop-up system timestamp, the original data is stored in the database; The data cleaning module is responsible for pre-processing the collected data. For a user, the fixed password, the number of data items per record is determined, and the data items whose data items do not match the predetermined length are eliminated; The model training module is responsible for analyzing and modeling each user's typing mode. The selected modeling features are the button delay, ie, the pop-up time, or the interval between each button is used to model; The user identity authentication module is responsible for performing model calculation on the new data to be tested to identify the identity of the user; collecting data entered by the user, and determining whether the user is a legitimate user according to the model built by the training module.

Images