CN109145554A - A kind of recognition methods of keystroke characteristic abnormal user and system based on support vector machines - Google Patents

Abstract

The invention discloses a method and system for identifying abnormal users of keystroke characteristics based on support vector machine. By acquiring the first sample behavior characteristic data of a preset sample input by a sample user, it includes the number of different error types of keystroke input characters, the number of keystroke input characters, and the number of keystrokes. The key speed, the average speed of keystrokes, the instantaneous speed of keystrokes, the accuracy of keystrokes, and the stability of keystrokes will be used as the behavioral feature library, which can better reflect the individual differences in user keystrokes and characterize the user's identity. The missing behavior feature data is processed as a preset behavior feature sample library after data completion processing, so that the sample user behavior feature data is more complete, and the recognition rate is greatly improved compared with the prior art.

Description

A method and system for identifying abnormal user of keystroke characteristics based on support vector machine

technical field

The invention relates to the field of pattern recognition, in particular to a method and system for identifying abnormal users of keystroke characteristics based on a support vector machine.

Background technique

At present, in Internet operation, password, password and user name authentication are the main user authentication methods. But the biggest problem with this mechanism is that it is easy to leak personal privacy. With the development of biometric authentication technologies such as machine learning and deep learning, new solutions have been provided for Internet identity authentication.

Biometric authentication technology uses each person's special physiological information and unique behavioral information, and these biometric information has strong identification and uniqueness, and can effectively screen abnormal users through biometric authentication technology.

Due to people's different keystroke habits and personal characters, each person forms his own unique keystroke pattern when entering a password or completing a piece of text input. The keystroke pattern can reflect a person's strength, speed, pause habits, etc., which are difficult to imitate. Further research has confirmed the uniqueness of people's keystroke characteristics, so the keystroke pattern can represent the user's identity. In order to achieve real-time statistical data in actual situations, there is a high probability that some data will be lost, which will easily lead to the problem of reducing the recognition rate.

SUMMARY OF THE INVENTION

Therefore, the present invention provides a support vector machine-based method and system for identifying users with abnormal keystroke characteristics, which solves the problem that the identification rate of users based on keystroke characteristics is low in the prior art.

A method for identifying users with abnormal keystroke characteristics based on a support vector machine provided by an embodiment of the present invention includes the following steps: acquiring behavior feature data of preset samples input by users to be identified; according to preset classification models and preset behaviors The feature sample library identifies the behavior feature data of the user to be identified, and generates a recognition result; the preset behavior feature sample library is established through the following steps: obtaining the first sample behavior feature data of the preset sample input by the sample user ; Carry out data completion processing to the missing behavioral feature data in the first sample behavioral feature data, form the second sample behavioral feature data, and use the second sample behavioral feature data as the preset behavioral feature sample library.

Preferably, the first sample behavior feature data includes at least one of the following contents: the number of different error types of keystroke input characters, the keystroke speed, the average keystroke speed, the keystroke instantaneous speed, the keystroke accuracy rate and Keystroke stability.

Preferably, the step of performing data completion processing on the missing behavior feature data in the first sample behavior feature data specifically includes: normalizing the first sample behavior feature data; The first sample behavior feature data after normalization is used to determine whether the behavior feature data of the sample users is lost; the sample users whose behavior feature data is not lost and their first sample behavior feature data are used as the training set, and the samples whose behavior feature data is lost are used as the training set. The user and its first sample behavior feature data are used as the test set, and the weight between the behavior feature of the unmissed data and the behavior feature of the missing data is determined according to the training set, the test set and the lasso regression model; according to the weight and training The set complements the missing behavioral feature data to form the second sample behavioral feature data.

Preferably, the step of completing the missing behavioral feature data according to the weight and the training set specifically includes: completing the feature value of the behavioral feature of the missing data according to the weight and the training set; Eigenvalues complement missing behavioral feature data.

Preferably, the weight between the unmissed behavioral features and the missing features is calculated by the following formula:

Among them, J(W) is the loss function, X is the eigenvalue of the behavioral feature that is not lost in the training set, N is the number of sample users, y is the eigenvalue of the behavioral feature that is lost in the training set, and w is the behavior that is not lost. The weight between the feature and the missing feature, α is a hyperparameter.

Preferably, according to the described weight and the training set to complete the missing behavioral characteristic data, in the step of forming the second sample behavioral characteristic data, the characteristic value of the behavioral characteristic of the missing data is calculated by the following formula:

in, is the feature value of the missing behavioral feature in the test set, w is the weight between the unmissed behavioral feature and the missing feature, and b is the bias value.

Preferably, after the step of completing the missing behavioral feature data according to the weight and the training set to form the second sample behavioral feature data, the method further includes:

Carrying out a correlation analysis on the behavior characteristic data of the second sample to obtain an analysis result;

According to the analysis result, the second sample behavior feature is screened; the filtered data is subjected to dimensionality reduction processing through principal component analysis; and the dimensionality reduction processed data is used as a user behavior feature sample library.

Preferably, dimension reduction processing is performed on the filtered data by the following formula:

Wherein, x ⁽ⁱ⁾ is the feature vector of the current dimension, x ⁽ⁱ⁾ _approx is the feature vector after dimension reduction processing, α is a preset threshold, and m represents the number of the sample users.

Preferably, the step of identifying the behavior feature data of the user to be identified according to a preset classification model and a preset behavior feature sample library, and generating an identification result, specifically includes:

Obtain a sample user set of the preset behavioral feature sample library; sequentially take one of the sample users in the sample user set as a positive set, and the other sample users as a negative set; according to the dimensionality reduction of the user to be identified The processed behavioral feature data and the support vector machine classification model are used to obtain identification results; the identification results are sorted, and the identity of the sample user corresponding to the maximum value of the identification results as a positive set is determined as the identity of the user to be identified ; determine whether the identity of the user to be identified belongs to the sample user set; when the identity of the user to be identified does not belong to the sample user set, determine that the user to be identified is an abnormal user.

Preferably, the step of identifying the behavior feature data of the user to be identified according to a preset classification model and a preset behavior feature sample library, and generating an identification result, specifically includes:

Obtain a sample user set of the user behavior feature sample library; take one of the user samples in the user set as a positive set, and the other user samples as a negative set; according to the dimension reduction processing of the user to be identified. Identify the behavioral feature data and the support vector machine classification model to obtain the identification result; sort according to the identification result, and judge whether the maximum value in the identification result is greater than a preset value; when the maximum value in the identification result is greater than a preset value; When it is greater than the preset value, the identity of the sample user as the positive set is determined as the identity of the user to be identified; when the maximum value in the identification result is less than the preset value, it is determined that the to-be-identified user The user is an abnormal user.

The embodiment of the present invention also provides a support vector machine-based user identification system for abnormal keystroke features, including: a user behavior feature extraction module to be identified, configured to obtain behavior feature data of a preset sample input by a user to be identified; The user classification module is used to classify the behavior feature data of the user to be identified according to a preset classification model and a preset behavior feature sample library, and generate a classification result. The preset behavioral feature sample library is established through the following steps:

Obtain the first sample behavior feature data of the preset sample input by the sample user; perform data completion processing on the missing behavior feature data in the first sample behavior feature data to form second sample behavior feature data, and combine the The second sample behavior feature data is used as the preset behavior feature sample library.

An embodiment of the present invention further provides a computer device, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, The instructions are executed by the at least one processor, so that the at least one processor executes the above-mentioned method for identifying an abnormal user of keystroke characteristics based on a support vector machine.

An embodiment of the present invention further provides a computer-readable storage medium, where computer instructions are stored in the computer-readable storage medium, and the computer instructions are used to make the computer perform the above-mentioned SVM-based keystroke feature abnormal user identification method.

The technical scheme of the present invention has the following advantages:

1. The method and system for identifying abnormal users of keystroke characteristics based on the support vector machine provided by the embodiment of the present invention, by obtaining the first sample behavior characteristic data of the preset sample input by the sample user, including the number of different error types of the keystroke input characters , keystroke speed, keystroke average speed, keystroke instantaneous speed, keystroke accuracy rate and keystroke stability, and use the behavioral characteristics that better reflect the individual differences of user keystrokes to characterize the user's identity as the behavioral feature database, so that the user to be identified can be identified. The identification rate of identity has been greatly improved.

2. The method and system for identifying abnormal users of keystroke features based on the support vector machine provided by the embodiment of the present invention, the behavioral feature data lost in the behavioral feature data is processed as a preset behavioral feature sample library after data completion processing, so that the sample User behavior characteristic data is more complete. Input the behavior feature data of the preset sample into the user to be identified, classify the behavior feature data of the user to be identified according to the preset classification model and the preset behavior feature sample library, generate a classification result to determine its identity, and then By judging whether it is an abnormal user, the recognition rate is greatly improved compared with the prior art.

Description of drawings

In order to illustrate the specific embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the specific embodiments or the prior art. Obviously, the accompanying drawings in the following description The drawings are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings without creative efforts.

1 is a flowchart of a specific example of a support vector machine-based keystroke feature abnormal user identification method provided in an embodiment of the present invention;

2 is a flowchart of a specific example of establishing a preset behavioral feature sample library provided in an embodiment of the present invention;

3 is a flowchart of an example of performing data completion processing on lost behavior feature data provided in an embodiment of the present invention;

4 is a flowchart of an example of performing dimension reduction processing on data after completion processing in an embodiment of the present invention;

5 is a flowchart of a specific example of generating a recognition result according to a preset classification model and a preset behavioral feature sample library according to an embodiment of the present invention, identifying the behavioral feature data of the user to be identified;

6 is a flowchart of another specific example of generating a recognition result according to a preset classification model and a preset behavioral feature sample library according to an embodiment of the present invention, identifying the behavioral feature data of the user to be identified;

7 is a schematic structural diagram of a support vector machine-based keystroke feature abnormal user identification system provided in an embodiment of the present invention;

FIG. 8 is a schematic structural diagram of a computer device provided in an embodiment of the present invention.

Detailed ways

The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are a part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

In addition, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

Example 1

An embodiment of the present invention provides a support vector machine-based method for identifying users with abnormal keystroke characteristics. As shown in FIG. 1 , the support vector machine-based method for identifying users with abnormal keystroke characteristics includes the following steps:

Step S1: Acquire behavior characteristic data of a preset sample input by a user to be identified.

In this embodiment of the present invention, the behavior characteristic data may be behavior characteristics of a preset sample input by a user through an input device such as a keyboard, and the behavior characteristic data may include: the number of different error types of keystroke input characters, the keystroke speed, the keystroke average Speed, instantaneous keystroke speed, keystroke accuracy and keystroke stability. Based on the analysis of behavioral characteristic data, the types of errors in which keystroke input characters differ are classified into the following categories:

(1) Bad case: keystroke error, such as ".The" input into ".";

(2) Bad ordering: When hitting a string of characters, enter a certain character too early, for example, enter "house" into "houes";

(3) Doublet: When tapping a string of strings, tap the same letter twice, for example, enter "home" into "homee";

(4) Other: other types of tapping errors;

(5) RED: There is an obvious error in the tap but no modification.

The above classification of different errors of keystroke input characters is only for illustration. In practical applications, the errors of different keystroke input characters can be adjusted according to the actual situation, and the present invention is not limited thereto.

In the embodiment of the present invention, the above-mentioned keystroke speed can be the keystroke speed input by the user as the number of correct characters input per minute; the average keystroke speed can be expressed as the number of correct characters input by the user within a preset time period; The instantaneous speed of keystrokes is the user's keystroke speed at the current moment; the keystroke accuracy is the ratio of the number of correct characters to the total number of characters entered; the stability of keystrokes can be expressed as the variance of the user's keystroke speed and the user's keystrokes Variance of accuracy.

Step S2: Identify the behavior feature data of the user to be identified according to the preset classification model and the preset behavior feature sample library, and generate an identification result.

The preset classification model in the embodiment of the present invention may be a support vector machine classification model. In order to improve the robustness of the support vector machine classification model, a slack variable is introduced for each sample. In order to control the influence on the solution, that is, to impose a penalty on the sample points far away from the center of the sphere, the constraints are shown in formula (1):

That is, the Euclidean distance from the feature vector x _i of the sample user to the center of the sphere is less than or equal to the radius plus the slack variable.

In the case of linear inseparability, the support vector machine first completes the calculation in the low-dimensional space, and then maps the input space to the high-dimensional feature space through the kernel function, and finally constructs the optimal separation hyperplane in the high-dimensional feature space, so that the Separating nonlinear data that is inherently indistinguishable on the plane. In the embodiment of the present invention, an optimized Gaussian kernel function is used to process nonlinear classification tasks, as shown in formula (2):

Among them, K(x, y) is the similarity between the behavior feature vectors X and Y, ‖xy‖ ² is the Euclidean distance, and σ is the variance between the feature vectors X and Y.

The decision function of the support vector machine is shown in formula (3):

f _SVD (z;α,R)=I(‖φ(z)-φ(α)‖ ² ≤R ² )

=I(K(z,z)-2∑ _i α _i K(z,x _i )+∑ _i,j α _i α _j K(x _i ,x _i )≤R ² ) (3)

Among them, K(z, z) is the similarity between Z and Z, which is 1, K(z, x _i ) is the similarity between Z and the ith sample, α _i is the weight, and R ² is the radius squared.

In a preferred embodiment, as shown in FIG. 2 , the above-mentioned preset behavioral feature sample library is established through the following steps:

Step S3: Obtain the first sample behavior characteristic data of the preset sample input by the sample user.

In this embodiment of the present invention, the first sample behavior feature data may be the behavior feature of a preset sample input by a user through an input device such as a keyboard, and the first sample behavior feature data includes: the above-mentioned different error types of keystroke input characters The number of keystrokes, the keystroke speed, the average keystroke speed, the keystroke instantaneous speed, the keystroke accuracy rate, the keystroke stability and the corresponding characteristic values. However, it is not limited to this, and other behavioral features may also be included in other embodiments.

Step S4: Perform data completion processing on the missing behavior feature data in the first sample behavior feature data to form second sample behavior feature data, and use the second sample behavior feature data as a preset behavior feature sample library.

In a preferred embodiment, as shown in FIG. 3 , the above-mentioned steps of performing data completion processing on the missing behavioral feature data in the first sample behavioral feature data specifically include:

Step S5: Normalize the behavior characteristic data of the first sample.

In the embodiment of the present invention, the feature values corresponding to the above-mentioned behavior features are normalized, so that the values are in the range of 0 to 1, so as to facilitate subsequent processing.

Step S6: Determine whether the behavior characteristic data of the sample user is lost according to the normalized first sample behavior characteristic data. In practical applications, some data may be lost. For example, when a user enters a string, he first typed "home" into "homme", then deleted it and retyped it into "hoem", according to the above-mentioned division of wrong types. , at this time, the user's Bad ordering indicator is accumulated once, but the Doublet is not accumulated, which leads to the loss of data. In addition, in actual situations, in order to achieve real-time statistical data, there is a high probability that some data will be lost.

Step S7: Take the sample users whose behavior feature data is not lost and their first sample behavior feature data as the training set, and the sample users whose behavior feature data is lost and their first sample behavior feature data as the test set. The ensemble and lasso regression models determine the weights between the behavioral features of the non-missing data and the behavioral features of the missing data.

In the embodiment of the present invention, Lasso regression is used to complete the missing data, the behavior characteristic data of the sample users whose behavior characteristic data is not lost is used as the training set, and the behavior characteristic data of the sample users whose behavior characteristic data is lost is used as the test set, The missing feature values of behavioral features in the test set are set as The behavioral feature of the missing data in the test set is denoted as x _k , the corresponding value of x _k in the training set is denoted as y, and the eigenvalue of the behavioral feature that is not lost except for x _k is denoted as X, and the non-missing behavioral feature is calculated by formula (4). Weight between behavioral features and missing behavioral features:

Among them, J(W) is the loss function, X is the eigenvalue of the behavioral feature that is not lost in the training set, N is the number of sample users, y is the eigenvalue of the missing behavioral feature of the training set, and w is the behavioral feature that is not lost and the missing feature The weight between, α is a hyperparameter. That is, when the above loss function J(W) is the smallest, the weight w between the unmissed behavioral features and the missing features is obtained, and the eigenvalues of the behavioral features of the missing data are calculated by formula (5):

in, is the eigenvalue of the missing behavioral feature in the test set, w is the weight between the unmissed behavioral feature and the missing feature, and b is the bias value.

Step S8: Completing the missing behavior feature data according to the weight and the training set to form a second sample behavior feature data.

In the embodiment of the present invention, the characteristic value of the behavior characteristic of the missing data is completed according to the above weight and the training set, and the missing behavior characteristic data is completed according to the characteristic value of the behavior characteristic of the missing data.

In a preferred embodiment, as shown in FIG. 4 , after the above-mentioned step S8 performs data completion processing on the lost behavior feature data, the method for identifying users with abnormal keystroke features further includes:

Step S9: Perform a correlation analysis on the behavior characteristic data of the second sample to obtain an analysis result.

Step S10: According to the analysis result, screen the behavior characteristics of the second sample.

In the embodiment of the present invention, the sample users tested are 11 people, a total of 88 samples (each person 8 inputs 8 paragraphs of text) as training data, and in practical applications, a small amount of data and a large number of features will lead to overfitting, In order to alleviate the over-fitting phenomenon and construct the verification number of the samples, in the embodiment of the present invention, correlation heat map analysis is used for feature screening, and cross-validation is used to verify whether the data is over-fitting.

In order to solve the over-fitting phenomenon, in the embodiment of the present invention, the above five error features are analyzed, and it is found during the sample user test that some features are highly correlated, for example, the user accidentally taps "home" As "hoeem", it belongs to both Bad ordering and Doublet, and the two often occur at the same time. Further, a correlation analysis is performed between the five error features. In the embodiment of the present invention, a threshold value of 0.5 is set. When the correlation between the two behavioral features |α| ≥ 0.5, it is considered that the correlation between the two behavioral features is very large, and α>0.5, indicating that the two features have High correlation can replace each other. When α<-0.5, it is considered that the two features inhibit each other and can also replace each other. Through this method, the behavioral features are screened. It should be noted that the value of the foregoing threshold is not limited to this, and may also be other values in other embodiments.

Step S11: Perform dimension reduction processing on the filtered data through principal component analysis.

In the embodiment of the present invention, principal component analysis is used for the features screened through the above step S10 to reduce the dimension and improve the operation efficiency. Principal component analysis is an unsupervised statistical method, usually with the help of orthogonal transformation, the component-related vector is converted into a component-independent vector. The intuitive performance in geometry is to convert the original coordinate system into an orthogonal one. Coordinate system, spread the sample points in multiple directions, and perform dimensionality reduction processing on multidimensional variables. Specifically, the filtered data can be dimensionally reduced by formula (6):

Among them, x ⁽ⁱ⁾ is the feature vector of the current dimension, x ⁽ⁱ⁾ _approx is the feature vector after dimension reduction, α is the preset threshold, and m represents the number of sample users. The threshold in this embodiment of the present invention is set to 0.01, but is not limited to this, and may also be other values in other embodiments.

Step S12: Use the data after dimensionality reduction processing as a sample library of user behavior characteristics.

In the embodiment of the present invention, the behavior feature data of the second sample after dimensionality reduction processing is used as a preset behavior feature sample library.

In a preferred embodiment, as shown in FIG. 5 , the above step S2 identifies the behavior feature data of the user to be identified according to a preset classification model and a preset behavior feature sample library, and generates a recognition result, which specifically includes: :

Step S211: Obtain a sample user set of a preset behavioral feature sample library.

There are 11 sample users in the embodiment of the present invention, so the user set is U={u ₁ , u ₂ , . . . , u _n } (n=11).

Step S212: Take one of the sample users in the sample user set as the positive set, and the other sample users as the negative set.

Step S213: Obtain a recognition result according to the behavior feature data of the user to be recognized after the dimension reduction process and the support vector machine classification model. In the embodiment of the present invention, let x={t ₁ , t ₂ ,...,t _m } be a user to be identified, and each t is a behavioral feature. In the embodiment of the present invention, the There are 6 behavioral features, so m=6.

Step S214: Sort the identification results, and determine the identity of the sample user corresponding to the maximum value of the identification result as the positive set as the identity of the user to be identified.

In the embodiment of the present invention, the behavior characteristics of sample users of a certain category are sequentially classified into one category, and the behavior characteristics of other remaining sample users are classified into another category, so that k categories of samples construct k A support vector machine classifier. In the embodiment of the present invention, there are 11 categories to be divided (that is, 11 Labels), and they are respectively U={u ₁ , u ₂ , ..., u _n } (n=11), so when extracting the training set , extract respectively:

1) The vector corresponding to u ₁ is used as a positive set, and the vector corresponding to U={u ₂ ,...,u _n }(n=11) is used as a negative set;

2) The vector corresponding to u ₂ is used as a positive set, and the vector corresponding to U={u ₁ , u ₃ , ..., u _n } (n=11) is used as a negative set;

3) The vector corresponding to u ₃ is used as a positive set, and the vector corresponding to U={u ₁ , u ₂ , ..., u _n } (n=11) is used as a negative set;

4) The vector corresponding to u ₄ is regarded as a positive set, and the vector corresponding to U={u ₁ , u ₂ , ..., u _n } (n=11) is regarded as a negative set, and so on.

5) Use these eleven training sets to train separately, and then obtain eleven classification results f ₁ (x), f ₂ (x), f ₃ (x)...f ₁₁ (x), among the eleven values The largest one is used as the classification result, and the identity of the corresponding sample user as the positive set is determined as the identity of the user to be identified.

Step S215: Determine whether the identity of the user to be identified belongs to the sample user set.

Step S216: when the identity of the user to be identified does not belong to the sample user set, determine that the user to be identified is an abnormal user.

In the embodiment of the present invention, when the user to be identified is one of the above-mentioned sample users, for example, the sample user u ₁ , and the user identity obtained after being classified by the classifier is that the sample user is the sample user u ₂ , it means that If the keystroke behavior of the user to be identified is abnormal, it is determined as an abnormal user.

In another embodiment, as shown in FIG. 6 , the above step S2 identifies the behavior feature data of the user to be identified according to a preset classification model and a preset behavior feature sample library, and generates a recognition result, which specifically includes:

Step S221: Obtain a sample user set of the user behavior feature sample library.

In the embodiment of the present invention, there are 11 sample users obtained in the embodiment of the present invention, so the set of users is U={u ₁ , u ₂ , . . . , u _n } (n=11).

Step S222: successively take one of the user samples in the user set as a positive set, and other user samples as a negative set;

Step S223: Recognize according to the behavior feature data of the user to be recognized after dimensionality reduction processing and the support vector machine classification model, and obtain the recognition result. In the embodiment of the present invention, let x={t ₁ , t ₂ ,...,t _m } be a user to be identified, and each t is a behavioral feature. In the embodiment of the present invention, the There are 6 behavioral features, so m=6.

Step S224: Sort according to the identification results, and determine whether the maximum value in the identification results is greater than a preset value.

In the embodiment of the present invention, the behavior characteristics of sample users of a certain category are sequentially classified into one category, and the behavior characteristics of other remaining sample users are classified into another category, so that k categories of samples construct k A support vector machine classifier. In the embodiment of the present invention, there are 11 categories to be divided (that is, 11 Labels), and they are U={u ₁ , u ₂ ,..., u _n } (n=11), so when extracting the training set, Extract separately:

1) The vector corresponding to u ₁ is used as a positive set, and the vector corresponding to U={u ₂ ,...,u _n }(n=11) is used as a negative set;

2) The vector corresponding to u ₂ is used as a positive set, and the vector corresponding to U={u ₁ , u ₃ , ..., u _n } (n=11) is used as a negative set;

3) The vector corresponding to u ₃ is used as a positive set, and the vector corresponding to U={u ₁ , u ₂ , ..., u _n } (n=11) is used as a negative set;

4) The vector corresponding to u ₄ is regarded as a positive set, and the vector corresponding to U={u ₁ , u ₂ , ..., u _n } (n=11) is regarded as a negative set, and so on.

5) Use these eleven training sets to train separately, and then get eleven classification results f ₁ (x), f ₂ (x), f ₃ (x)...f ₁₁ (x), and then compare the eleven The identification results are sorted, and it is determined whether the maximum value in the identification results is greater than a preset value. The preset value in this embodiment of the present invention is 0.8, but it is not limited to this. In other embodiments, it can also be set according to application scenarios. value of .

Step S225: when the maximum value in the identification result is greater than the preset value, determine the identity of the sample user as the positive set as the identity of the user to be identified.

Step S226: when the maximum value in the identification result is smaller than the preset value, determine that the user to be identified is an abnormal user.

In this embodiment of the present invention, after the behavioral characteristics of the user to be identified are classified by the classifier and the behavioral characteristic sample library, a preset value needs to be set for the classification result, and its identity can be determined only when it is greater than the preset value. Which of the sample users belongs to, when it is less than the preset value, it is an abnormal user.

The method for identifying users with abnormal keystroke characteristics based on the support vector machine provided by the embodiment of the present invention obtains the first sample behavior characteristic data of the preset sample input by the sample user, including the number of different error types of keystroke input characters and the keystroke speed. , The average speed of keystrokes, the instantaneous speed of keystrokes, the accuracy of keystrokes, and the stability of keystrokes, and the behavioral features that better reflect the individual differences of users' keystrokes and characterize the user's identity are used as the behavioral feature database. The behavior feature data is used as a preset behavior feature sample library after data completion processing, so that the sample user behavior feature data is more complete, and the recognition rate is greatly improved compared with the prior art.

Example 2

An embodiment of the present invention provides a support vector machine-based keystroke feature abnormal user identification system. As shown in FIG. 7 , the support vector machine-based keystroke feature abnormal user identification system includes:

The behavior feature extraction module 1 of the user to be identified is configured to obtain behavior feature data of a preset sample input by the user to be identified. This module specifically executes the method of step S1 in Embodiment 1, and details are not repeated here.

The to-be-identified user classification module 2 is configured to classify the behavioral feature data of the to-be-identified user according to a preset classification model and a preset behavioral feature sample library, and generate a classification result. This module specifically executes the method of step S2 in Embodiment 1, and details are not repeated here.

In this embodiment of the present invention, for the method for establishing the above-mentioned preset behavior feature library, reference may be made to steps S3 to S12 recorded in Embodiment 1, and details are not described herein again.

The support vector machine-based user identification system for abnormal keystroke characteristics provided by the embodiment of the present invention obtains the first sample behavior characteristic data of the preset sample input by the sample user, including the number of different error types of keystroke input characters and the keystroke speed. , The average speed of keystrokes, the instantaneous speed of keystrokes, the accuracy of keystrokes, and the stability of keystrokes, and the behavioral features that better reflect the individual differences of users' keystrokes and characterize the user's identity are used as the behavioral feature database. The behavior feature data is used as a preset behavior feature sample library after data completion processing, so that the sample user behavior feature data is more complete, and the recognition rate is greatly improved compared with the prior art.

Example 3

An embodiment of the present invention provides a computer device, as shown in FIG. 8 , including: at least one processor 401 , such as a CPU (Central Processing Unit, central processing unit), at least one communication interface 403 , a memory 404 , and at least one communication bus 402 . Among them, the communication bus 402 is used to realize the connection and communication between these components. The communication interface 403 may include a display screen (Display) and a keyboard (Keyboard), and the optional communication interface 403 may also include a standard wired interface and a wireless interface. The memory 404 may be a high-speed RAM memory (Ramdom Access Memory, volatile random access memory), or may be a non-volatile memory (non-volatile memory), such as at least one disk memory. The memory 404 can optionally also be at least one storage device located away from the aforementioned processor 401 . The processor 401 can be combined with the support vector machine-based keystroke feature abnormal user identification system described in FIG. 3, a set of program codes are stored in the memory 404, and the processor 401 calls the program codes stored in the memory 404 for executing the system based on The method for identifying users with abnormal keystroke characteristics by a support vector machine is used to implement the method for identifying users with abnormal keystroke characteristics based on the support vector machine in the embodiments of FIG. 1 to FIG. 6 .

The communication bus 402 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus or the like. The communication bus 402 can be divided into an address bus, a data bus, a control bus, and the like. For ease of presentation, only one thick line is used in FIG. 8, but it does not mean that there is only one bus or one type of bus.

The memory 404 may include volatile memory (English: volatile memory), such as random-access memory (English: random-access memory, abbreviation: RAM); the memory may also include non-volatile memory (English: non-volatile memory) memory), such as flash memory (English: flash memory), hard disk (English: hard diskdrive, abbreviation: HDD) or solid-state drive (English: solid-state drive, abbreviation: SSD); the memory 404 may also include the above-mentioned types of memory The combination.

The processor 401 may be a central processing unit (English: central processing unit, abbreviation: CPU), a network processor (English: network processor, abbreviation: NP), or a combination of CPU and NP.

The processor 401 may further include a hardware chip. The above-mentioned hardware chip may be an application-specific integrated circuit (English: application-specific integrated circuit, abbreviation: ASIC), a programmable logic device (English: programmable logic device, abbreviation: PLD) or a combination thereof. The above-mentioned PLD may be a complex programmable logic device (English: complex programmable logic device, abbreviation: CPLD), a field programmable gate array (English: field-programmable gate array, abbreviation: FPGA), a general-purpose array logic (English: generic arraylogic , abbreviation: GAL) or any combination thereof.

Optionally, memory 404 is also used to store program instructions. The processor 401 may invoke program instructions to implement the support vector machine-based method for identifying abnormal users of keystroke characteristics as in the embodiments 1 to 6 of the present application.

Embodiments of the present invention further provide a computer-readable storage medium, where computer-executable instructions are stored on the computer-readable storage medium, and the computer-executable instructions can execute the support vector machine-based keystroke feature exception in any of the foregoing method embodiments User identification method. Wherein, the storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a flash memory (FlashMemory), a hard disk (Hard Disk) Drive, abbreviation: HDD) or solid-state drive (Solid-State Drive, SSD), etc.; the storage medium may also include a combination of the above-mentioned types of memories.

As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block in the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions The apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

Obviously, the above-mentioned embodiments are only examples for clear description, and are not intended to limit the implementation manner. For those of ordinary skill in the art, changes or modifications in other different forms can also be made on the basis of the above description. There is no need and cannot be exhaustive of all implementations here. And the obvious changes or changes derived from this are still within the protection scope of the present invention.

Claims (13)

1. A keystroke characteristic abnormal user identification method based on a support vector machine is characterized by comprising the following steps:

acquiring behavior characteristic data of a user input preset sample to be identified;

identifying the behavior feature data of the user to be identified according to a preset classification model and a preset behavior feature sample library to generate an identification result;

establishing the preset behavior characteristic sample library by the following steps:

acquiring first sample behavior characteristic data of a preset sample input by a sample user;

and performing data completion processing on the behavior characteristic data lost in the first sample behavior characteristic data to form second sample behavior characteristic data, and taking the second sample behavior characteristic data as the preset behavior characteristic sample library.

2. The support vector machine-based keystroke characteristic exception user identification method of claim 1, wherein said first sample behavior characteristic data comprises at least one of: the number of different error types of the keystroke input characters, the keystroke speed, the average keystroke speed, the instantaneous keystroke speed, the keystroke accuracy and the stability of the keystroke.

3. The method for identifying a keystroke characteristic abnormality based on a support vector machine according to claim 1, wherein the step of performing data completion processing on the behavior characteristic data lost in the first sample behavior characteristic data specifically comprises:

normalizing the first sample behavior feature data;

judging whether the behavior characteristic data of the sample user is lost or not according to the first sample behavior characteristic data after normalization processing;

taking the sample user without losing the behavior characteristic data and the first sample behavior characteristic data as a training set, taking the sample user with losing the behavior characteristic data and the first sample behavior characteristic data as a testing set, and determining the weight between the behavior characteristic of the data without losing and the behavior characteristic of the data losing according to the training set, the testing set and a lasso regression model;

and completing the lost behavior characteristic data according to the weights and the training set to form second sample behavior characteristic data.

4. The method according to claim 3, wherein the step of completing the missing behavior feature data according to the weights and the training set specifically comprises:

completing the characteristic value of the behavior characteristic of the lost data according to the weight and the training set;

and completing the lost behavior characteristic data according to the characteristic value of the behavior characteristic of the lost data.

5. The method of claim 4, wherein the weight between the behavior feature of the non-lost data and the behavior feature of the lost data is calculated by the following formula:

wherein j (w) is a loss function, X is a feature value of the behavior feature of the non-lost data in the training set, N is the number of sample users, y is a feature value of the behavior feature of the lost data in the training set, w is a weight between the behavior feature of the non-lost data and the behavior feature of the lost data, and α is a hyperparameter.

6. The method of claim 5, wherein the characteristic value of the behavior characteristic of the missing data is calculated by the following formula:

wherein,and the characteristic value of the behavior characteristic of the lost data in the test set is W, the weight between the behavior characteristic of the unreleased data and the behavior characteristic of the lost data is W, and b is a bias value.

7. The method of claim 6, further comprising, after the step of completing the missing behavior feature data according to the weights and training set to form a second sample behavior feature data:

performing correlation analysis on the second sample behavior characteristic data to obtain an analysis result;

screening the second sample behavior characteristics according to the analysis result;

performing dimensionality reduction on the screened data through principal component analysis;

and taking the data subjected to the dimensionality reduction processing as a user behavior characteristic sample library.

8. The method for identifying abnormal user of keystroke characteristics based on support vector machine of claim 7, wherein the screened data is processed by dimension reduction according to the following formula:

wherein x is⁽ⁱ⁾Is a feature vector of the current dimension, x⁽ⁱ⁾ _approxIs the feature vector after the dimension reduction process, α is a preset threshold, and m represents the number of the sample users.

9. The method for identifying users with abnormal keystroke characteristics based on a support vector machine as claimed in claim 8, wherein the step of identifying the behavior characteristic data of the user to be identified according to a preset classification model and a preset behavior characteristic sample library to generate an identification result specifically comprises:

acquiring a sample user set of the preset behavior characteristic sample library;

one sample user in the sample user set is used as a positive set, and other sample users are used as negative sets in sequence;

obtaining an identification result according to the behavior characteristic data of the user to be identified after the dimension reduction processing and a support vector machine classification model;

sorting the recognition results, and determining the identity of the sample user as a positive set corresponding to the maximum value of the recognition results as the identity of the user to be recognized;

judging whether the identity of the user to be identified belongs to the sample user set;

and when the identity of the user to be identified does not belong to the sample user set, judging that the user to be identified is an abnormal user.

10. The method for identifying users with abnormal keystroke characteristics based on a support vector machine as claimed in claim 9, wherein the step of identifying the behavior characteristic data of the user to be identified according to a preset classification model and a preset behavior characteristic sample library to generate an identification result specifically comprises:

acquiring a sample user set of the user behavior characteristic sample library;

one user sample in the user set is used as a positive set, and other user samples are used as negative sets in sequence;

identifying according to the behavior feature data of the user to be identified after the dimension reduction processing and a support vector machine classification model to obtain an identification result;

sorting according to the identification results, and judging whether the maximum value in the identification results is greater than a preset value;

when the maximum value in the identification result is larger than the preset value, determining the identity of the sample user as a positive set as the identity of the user to be identified;

and when the maximum value in the identification result is smaller than the preset value, judging that the user to be identified is an abnormal user.

11. A keystroke characteristic abnormal user identification system based on a support vector machine is characterized by comprising:

the user behavior feature extraction module is used for acquiring behavior feature data of a user input preset sample to be identified;

the user classification module to be recognized is used for classifying the behavior characteristic data of the user to be recognized according to a preset classification model and a preset behavior characteristic sample library to generate a classification result;

establishing the preset behavior characteristic sample library by the following steps:

acquiring first sample behavior characteristic data of a preset sample input by a sample user;

and performing data completion processing on the behavior characteristic data lost in the first sample behavior characteristic data to form second sample behavior characteristic data, and taking the second sample behavior characteristic data as the preset behavior characteristic sample library.

12. A computer device, comprising: at least one processor, and a memory communicatively coupled to the at least one processor, wherein the memory stores instructions executable by the at least one processor, the instructions being executable by the at least one processor to cause the at least one processor to perform the method for identifying keystroke characteristic anomalies based on a support vector machine of any of claims 1-10 above.

13. A computer-readable storage medium storing computer instructions for causing a computer to perform the method for identifying abnormal user characteristics of keystrokes on a support vector machine according to any one of claims 1 to 10.