CN109871676A - Three identity identifying methods and system based on mouse behavior - Google Patents
Three identity identifying methods and system based on mouse behavior Download PDFInfo
- Publication number
- CN109871676A CN109871676A CN201910191823.XA CN201910191823A CN109871676A CN 109871676 A CN109871676 A CN 109871676A CN 201910191823 A CN201910191823 A CN 201910191823A CN 109871676 A CN109871676 A CN 109871676A
- Authority
- CN
- China
- Prior art keywords
- mouse
- user
- behavior
- indicate
- legal
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Abstract
The invention belongs to field of identity authentication, and in particular to a kind of three based on mouse behavior identity identifying method and system, the method includes carrying out mouse data acquisition and carry out duplicate removal processing to the data after acquisition and go abnormality processing；The data sequence being made of multiple basic mouse actions calculates feature vector according to mouse behavior, to calculate relevant characteristic value as a mouse behavior；Modeling is carried out to the mouse features of acquisition and obtains three Model of Identity Authentication System, model output sample belongs to the probability value of legal mouse user, obtains carrying out required threshold value of classifying by loss function, sample object is divided in positive domain, Boundary Region or negative domain；Negative domain sample object is determined as illegal mouse user, positive domain sample object is determined as that legal mouse user, Boundary Region mouse user continue to authenticate.The present invention is determining mouse number or is doing a decision before the time in advance, hopes in authenticated time in more lowstand and reaches higher authentication precision.
Description
Technical field
The invention belongs to field of identity authentication, and in particular to a kind of three based on mouse behavior identity identifying method and be
System.
Background technique
Realize that reliable authentication is to protect a critical issue of application and service safety in network, and be based on mouse
The method of behavioural characteristic does not need the hardware device of additional expensive, it is only necessary to which present invention mouse usually used, which collects the present invention, to be made
Interaction data when with computer, extracts useful feature, and mouse can be used by training disaggregated model using these features
The legitimacy of family identity is authenticated.Many scholars propose the identity identifying method based on mouse behavior.Xu Jian et al. is proposed
" identity identifying method based on mouse user's mouse behavior " in using the mobile distance of mouse in mouse user mouse behavior,
The feature extractions such as the mobile speed of mouse one identifies the preliminary scheme of legal mouse user identity based on these differences.
" the An efficient user verification system via mouse movements " that Zheng N et al. is proposed
Key feature in system is to carry out mouse user based on the mouse Mobility metrics of angle using more fine granularity (point-to-point)
Verifying, this new measurement can distinguish each mouse user independently of computing platform.And use SVM as classifier
It is trained." the A New Biometric Technology Based on Mouse that Ahmed A A E et al. is proposed
Basic mouse event is divided into low layer by a kind of method that hierarchical partition mouse user behavior is referred in Dynamics "
Secondary mouse behavior, the mouse behavior of low level links according to certain rules forms high-level mouse behavior, and gives
The calculation method of the characteristic value for the different behaviors for needing to extract.Finally it is trained to obtain one as classifier using random forest
A two classifier.
Mouse user is directly determined as legal mouse user or illegal by all direct two classifiers of training in existing method
Mouse user causes the existing model of authentication to obtain the shortcomings that high authentication precision needs to correspond to high authenticated time.
However some mouses user is the legitimacy that can judge its identity in advance, can waste a large amount of time in this way.
Summary of the invention
Based on problem of the existing technology, proposes a kind of three based on mouse behavior identity identifying method and be
System, the described method comprises the following steps:
Step 1 carries out mouse data acquisition, and acquisition t moment includes timestamp, key, state and pointer in screen
Position five-tuple mouse action (ts,bs,ss,xs,ys)t；And duplicate removal processing is carried out to the data after acquisition and goes exception
Processing；tsIndicate the timestamp in point s, bsIndicate the key in point s, ssIndicate the state in point s, xsAnd ysIt indicates point s's
Mouse transverse and longitudinal coordinate；
Step 2, the data sequence being made of multiple basic mouse actions are as a mouse behavior, according to mouse behavior meter
Feature vector is calculated, to calculate relevant characteristic value；
Step 3 constructs Random Forest model based on mouse features, obtains the pre- of sample object by the Random Forest model
Survey probability；
Prediction probability is inputted three Model of Identity Authentication System by step 4；It is calculated by loss function needed for being classified
Positive domain threshold alpha and negative domain threshold value beta, sample object is divided in positive domain, Boundary Region or negative domain；The sample object of negative domain is sentenced
Be set to illegal mouse user, the sample object in positive domain be determined as legal mouse user, by the sample object of Boundary Region continue into
Row certification.
It is understood that further include being trained to model using sample data during this, so as to will be to be predicted
Or in sample input model to be sorted, obtain last authentication result.
Further, the mouse behavior includes:
Moving distance S: the path length that mouse behavior is moved from starting point to end point is indicated；
Time Δ T: time used in indicating mouse behavior from starting point to end point；
Movement speed vk: indicate the movement speed between two mouse actions；
Translational acceleration ak: indicate the translational acceleration between two mouse actions；
Mobile acceleration jerkk: indicate the mobile acceleration between two mouse actions；
Move angle θk: indicate the angle of two mouse action motion tracks；
Mobile angular speed wk: indicate the angular speed of two mouse action motion tracks；
Curvature ck: indicate the curvature of two mouse action motion tracks；
Straightness st: the flatness of mouse sequence starting point to end point.
Further, the probability of three Model of Identity Authentication System input are as follows:
Wherein, P (C | X) indicates that object x belongs to the conditional probability of classification C；N indicates the trees tree in random forest；Pi
Indicate the prediction probability of i-th tree.
Further, the positive domain threshold alpha and negative domain threshold value beta for classifying required indicate are as follows:
Wherein, λPPIndicate the loss that legal mouse user is determined as to legal mouse user, λPNIllegal mouse is used in expression
Family is determined as the loss of legal mouse user, λBPIndicate the loss that legal mouse user is determined as to Delayed Decision mouse user,
λBNIndicate the loss that illegal mouse user is determined as to Delayed Decision mouse user, λNPLegal mouse user is determined as by expression
The loss of illegal mouse user, λNNIndicate the loss that illegal mouse user is determined as to illegal mouse user.
On the basis of method proposed by the present invention, the invention also provides a kind of three based on mouse behavior identity to recognize
Card system, the system comprises the mouse data acquisition module being successively electrically connected, behavior characteristic extraction module, three identity to recognize
Model of a syndrome constructs module and identity detects decision-making module；The mouse data acquisition module is used to carry out mouse data acquisition,
Duplicate removal processing is carried out to the data after acquisition and goes abnormality processing；The behavior characteristic extraction module is for adopting mouse data
The mouse data that collection resume module is crossed is combined into the mouse behavior of mouse user, and calculates each characteristic value of mouse behavior；Institute
Three Model of Identity Authentication System building modules are stated to be used to carry out modeling to behavior characteristic extraction module acquisition mouse features to obtain model,
Sample object is divided in positive domain, Boundary Region or negative domain；The identity detection decision-making module is used to pass through three authentications
Model authenticates sample object, including judgement sample object is legal mouse user or illegal mouse user or Delayed Decision
Mouse user.
Further, three Model of Identity Authentication System building module includes random forest unit, loss function unit, threshold
Value cell and behavioural characteristic unit；The random forest unit is used to export the prediction probability of sample object；The loss letter
Counting unit is for constructing loss function；The threshold cell is used to generate positive domain threshold value and negative domain threshold value according to loss function；Institute
Behavioural characteristic unit is stated for determining the behavior of mouse user.
Further, the probability of the random forest unit output, the i.e. probability of three Model of Identity Authentication System input are as follows:
Wherein, P (C | X) indicates that object x belongs to the conditional probability of classification C；N indicates the trees tree in random forest；Pi
Indicate the prediction probability of i-th tree.
Further, loss function unit calculates positive domain threshold value and negative domain threshold value by loss function, indicates are as follows:
Wherein, λPPIndicate the loss that legal mouse user is determined as to legal mouse user, λPNIllegal mouse is used in expression
Family is determined as the loss of legal mouse user, λBPIndicate the loss that legal mouse user is determined as to Delayed Decision mouse user,
λBNIndicate the loss that illegal mouse user is determined as to Delayed Decision mouse user, λNPLegal mouse user is determined as by expression
The loss of illegal mouse user, λNNIndicate the loss that illegal mouse user is determined as to illegal mouse user.
Beneficial effects of the present invention:
1, for the present invention by using three decisions, existing model is reaching higher accuracy and lower False Rejects
While rate and false acceptance rate, the less time has been used.
2, three decision models are reaching very close to higher accuracy and lower false rejection rate and mistake receiving
While rate, the expectation of authenticated time is greatly reduced.
Detailed description of the invention
Fig. 1 is the Model of Identity Authentication System frame diagram based on mouse behavior in the present invention；
Fig. 2 is that identity detects decision-making module figure in the present invention.
Specific embodiment
In order to make the objectives, technical solutions, and advantages of the present invention clearer, below in conjunction with attached drawing to of the invention real
The technical solution applied in example is clearly and completely described, it is clear that described embodiment is only that present invention a part is implemented
Example, instead of all the embodiments.
The present invention proposes the basic framework of three Model of Identity Authentication System, as shown in Figure 1；The frame mainly includes 4 modules:
Mouse data acquisition module, behavior characteristic extraction module, three Model of Identity Authentication System buildings and decision-making module.
One, mouse data acquisition module
The present invention by each moment of original mouse data be set as 5 tuples (timestamp, button, state,
X, y), the present invention is known as a mouse action, including following several properties: timestamp (timestamp), key (button),
State (state), position (x, y) of the pointer in screen, as shown in table 1.
1 mouse data table of table
| timestamp | button | state | x | y |
| 0.0 | NoButton | Move | 126 | 337 |
| 0.016 | NoButton | Move | 129 | 337 |
| 0.031 | NoButton | Move | 136 | 337 |
| 0.047 | NoButton | Move | 155 | 339 |
| 0.063 | NoButton | Move | 185 | 340 |
In the present invention, key (button) indicates the current state of mouse button.There is a left, tri- kinds of right, nobutton
Attribute value respectively corresponds left button, right button and does not have that a button is pressed.
State (state) indicates the additional information about mouse current state.Specifically include state pressed,
Released, drag and move；Respectively correspond the state for being described as recording when mousebutton is pressed, mousebutton is released
The state of Shi Jilu presses mousebutton, after moving a distance, bounces end and mouse from certain point with mousebutton
The state recorded when being moved to another point；The abnormal data that the present invention will dispose in initial data, such as two just the same
Repeated data, the data etc. of screen position exception, to prepare for next step feature extraction.
Two, behavior characteristic extraction module
Mouse behavior proposed by the present invention include the following:
(1) mouse mobile behavior (Mouse-Move, abbreviation MM): mouse user using mouse carry out moving operation, i.e., from
To another point on screen after a little mobile a distance on screen.
(2) mouse is directed toward click behavior (Point-and-Click, abbreviation PC): mouse user is completed using mouse
The operation behavior once clicked after mobile behavior.
(3) double click behavior (Double-Click, abbreviation DC): mouse user is using mouse completion primary mobile
The operation behavior of primary double-click has been carried out after behavior.Wherein clicking operation time interval is not more than τ twicePC-DC；τPC-DCIndicate single
Double-press time threshold value, i.e. time interval between mouse-click behavior twice.
(4) mouse drag behavior (Drag-and-Drop, abbreviation DD): after mouse user uses mouse down mousebutton
Mobile a distance, then discharges the operation behavior of key.
(5) the static click behavior (Silence-Click, abbreviation SC) of mouse: mouse user is pressed using mouse down mouse
After key, moving distance distance is less than τDD-SCThen the operation behavior of key is discharged；τDD-SCIt indicates moving distance threshold value, that is, pulls
The moving distance of behavior.
(6) the static behavior of mouse (Silence): mouse coordinates are constant in subsequent time position in same position.
Feature vector is calculated according to above-mentioned mouse behavior, one can be obtained by basic mouse for each mouse behavior
The data sequence of mark operation composition, the present invention can obtain the horizontal axis coordinate at corresponding moment and be indulged according to the time t in data
Axial coordinate, and then calculate relevant characteristic value.Introduce the calculation method of main feature value in this part, it is assumed that a mouse behavior
Sequence is (ts,bs,ss,xs,ys), (ts+1,bs+1,ss+1,xs+1,ys+1) ..., (te,be,se,xe,ye), then the calculating of characteristic value
It is as follows:
1. moving distance S: indicating the path length that mouse behavior is moved from starting point s to end point e.
2. time Δ T: mouse behavior time used in the starting point s to end point e is indicated, wherein setting Δ tk=tk+1-
tk。
3. movement speed vk: indicate the movement speed between two mouse actions.
4. translational acceleration ak: indicate the translational acceleration between two mouse actions.
5. mobile acceleration jerkk: indicate the mobile acceleration between two mouse actions.
6. move angle θk: indicate the angle of two mouse action motion tracks.
7. mobile angular speed wk: indicate the angular speed of two mouse action motion tracks.
8. curvature ck: indicate the curvature of two mouse action motion tracks.
9. straightness st: the flatness of mouse sequence starting point s to end point e.
According to above-mentioned essential characteristic value, characteristic value required for the present invention calculates is as shown in table 2.
Table 2 needs to calculate resulting feature
Three, three Model of Identity Authentication System construct module
In the present invention, the probability that Random Forest model predicts is divided using three decisions, to obtain higher
Accuracy and lower false rejection rate and false acceptance rate；Wherein in three decisions positive domain threshold value and negative domain threshold value meter
Calculating formula includes:
Wherein, λPPIndicate the loss that legal mouse user is determined as to legal mouse user, λPNIllegal mouse is used in expression
Family is determined as the loss of legal mouse user, λBPIndicate the loss that legal mouse user is determined as to Delayed Decision mouse user,
λBNIndicate the loss that illegal mouse user is determined as to Delayed Decision mouse user, λNPLegal mouse user is determined as by expression
The loss of illegal mouse user, λNNIndicate the loss that illegal mouse user is determined as to illegal mouse user.
As another optional way, the loss function further include:
AndSuccessively indicate that the i-th data is to judge legitimate user
It is determined as legal mouse user for legitimate user, by illegal mouse user, legal mouse user is determined as Delayed Decision mouse
User, illegal mouse user is determined as Delayed Decision mouse user, legal mouse user is determined as to illegal mouse user with
And illegal mouse user is determined as to the loss factor of illegal mouse user；Wherein:
Wherein, h (xi) it is prediction result obtained by the i-th data, x in mouse featuresiFor the i-th data institute in mouse features
Character pair data；yiFor true tag value corresponding to the i-th data in mouse features.By minimizing formula (12), ask
Each loss is solved, to obtain optimal positive domain threshold value and negative domain threshold value.
As another optional way, the acquisition modes of positive domain threshold value and negative domain threshold value further include:
The conditional probability for calculating classification first obtains the sample of threshold calculations using leaving-one method on training set, by dividing
The distribution situation of probability obtains last threshold value in analysis sample.Specifically, the sorted probability distribution of data two is obtained, according to
Real example (true positive, abbreviation TP), true counter-example (true negative, abbreviation TN), false positive example (false
Positive, abbreviation FP), false counter-example (false negative, abbreviation FN) is counted.By above-mentioned in two classifiers of analysis
The tetrameric probability value of problem, if the indices of the part TP probability value are greater than FP, the part TN and FN, and the part FN probability value
Indices be less than TP, the part FP and TN, it may be considered that resulting classifier is to have pole in the decision that the part TP is made
The decision that the receiving of maximum probability and the part FN are made has the refusal of maximum probability, and is unascertainable determine in the part FP and TN
Plan, and α value is chosen in the statistical indicator of the part TP, β value is chosen in the statistical indicator of the part FN.Preferably, the portion TP is selected
Point the first quantile, median, third quantile, average or mode be used as α value, selection the part FN the first quantile,
Median, third quantile, average or mode are as β value.
It in the present invention, is designed using three Decision Classfication devices based on random forest, the present invention constructs random forest to count
Calculate the prediction probability P of test sample.Stochastic decision tree is constructed based on training set, and it is random gloomy that these trees combine composition
Woods.One prediction probability can be generated for test object each tree, the present invention is by seeking being averaged for these each tree probability
Value obtains the conditional probability for three Decision Classfications.If sharing N tree in random forest, the prediction probability of i-th tree is Pi,
Then object x belongs to the conditional probability of positive class are as follows:
The present invention is using above-mentioned probability as the input of three Model of Identity Authentication System, the characteristic extracted using above-mentioned module
According to for legal mouse user 1000 behavioral datas of extraction as positive sample, illegal mouse user chooses 1000 behavior numbers
According to as negative sample, random forest is used to carry out model training as classifier.In order to obtain the threshold value of three divisions, according to warp
The loss function that setting object divides is tested, threshold alpha and β are calculated according to loss function, in the present invention, as a kind of optional side
Formula, by λPP=0, λPN=9, λBP=4, λBN=3, λNP=9, λNN=0.This threshold value is α=0.6, β=0.375.Certainly according to three
Plan theory determines decision process, can be divided to object in positive domain, Boundary Region and negative domain, that is to say Random Forest model is defeated
Division in probability out greater than 0.6 is positive domain, be divided into negative domain less than 0.375, and 0.375~0.6 is divided into Boundary Region,
It is further continued for carrying out three decisions.
Four, identity detects decision-making module
Identity detection decision-making module is responsible for carrying out mouse user using three Model of Identity Authentication System of building and threshold alpha and β
Classification, the mouse user for output sample probability value less than β are directly determined as illegal mouse user, for exporting sample probability
Mouse user of the value greater than α is directly determined as legal mouse user, is more than or equal to β for output sample probability value and is less than or equal to
Data of more collections are once authenticated the mouse user present invention of α again again.
In the present invention, the system comprises the mouse data acquisition module being successively electrically connected, behavior characteristic extraction module,
Three Model of Identity Authentication System building modules and identity detect decision-making module；The mouse data acquisition module is for carrying out mouse
Data after acquisition are carried out duplicate removal processing and go abnormality processing by data acquisition；The behavior characteristic extraction module is used for will
The processed mouse data of mouse data acquisition module is combined into the mouse behavior of mouse user, and calculates each of mouse behavior
Characteristic value；Three Model of Identity Authentication System building module is used to obtain mouse features to behavior characteristic extraction module and model
Model is obtained, sample object is divided in positive domain, Boundary Region or negative domain；The identity detection decision-making module is used to pass through three
Model of Identity Authentication System authenticates sample object, including judgement sample object be legal mouse user or illegal mouse user or
Delayed Decision mouse user.
Specifically,
Mouse data acquisition module is responsible for acquiring the original mouse behavioral data of mouse user, and is pre-processed, right
Some exceptional values are deleted etc..This module will obtain significant mouse behavioral data.
Behavior characteristic extraction module is responsible for the processed mouse data of mouse data acquisition module being combined into mouse user
Mouse behavior, and calculate each characteristic value of mouse behavior.
Three Model of Identity Authentication System building modules obtain mouse features progress random forest to behavior characteristic extraction module and build
Mould, obtains model, and model output sample belongs to the probability value of legal mouse user, then obtains the present invention by loss function
Carry out the threshold alpha for classifying required and β.Three Model of Identity Authentication System building module includes random forest unit, loss function
Unit, threshold cell and behavioural characteristic unit；The random forest unit is determined for constructing multiple stochastic decision trees to each
The prediction probability that plan tree generates is averaged, to export the prediction probability of sample object；The loss function unit is used for structure
Make loss function；The threshold cell is used to generate positive domain threshold value and negative domain threshold value according to loss function；The behavioural characteristic list
Member includes determining whether that user is legal mouse user, for illegal mouse user or is delay for determining the behavior of mouse user
Decision mouse user.
Identity detection decision-making module is responsible for carrying out mouse user using three Model of Identity Authentication System of building and threshold alpha and β
Classification, the mouse user for output sample probability value less than β are directly determined as illegal mouse user, for exporting sample probability
Mouse user of the value greater than α is directly determined as legal mouse user, is more than or equal to β for output sample probability value and is less than or equal to
Data of more collections are once authenticated the mouse user present invention of α again again, as shown in Figure 2.
Embodiment 2
The present embodiment carries out application of three Model of Identity Authentication System proposed by the present invention in authentication furtherly
It is bright；
The public data collection that the data that the present embodiment uses provide for Balabit is as the mouse data being collected into, part
Data are as shown in table 1.
Data prediction, deleting duplicated data, abnormal data etc. are carried out to initial data first.
Required mouse features value is calculated according to the mouse behavior of above-mentioned introduction and feature calculation method and as mould
Type training data.The mouse partial feature value being calculated is as shown in table 3.
3 mouse data characteristic value of table
Error caused by imbalance in order to avoid training data, the present invention select legal mouse user and illegal mouse
User each 1000 are used as training data.Random forests algorithm is used to be trained as classifier.And in test integrated test
Testing model effect.By the misclassification rate (false acceptance rate, abbreviation FAR) of different models and reject rate (false
Rejection rate, abbreviation FRR) it compares.
Different threshold values, which is obtained, by the way that different loss function is arranged can obtain different-effect, if the present invention wish be
It unites safer, obtains lower FAR, then bigger λ is arrangedPN, i.e. λPP=0, λPN=18, λBP=4, λBN=3, λNP=9, λNN
=0.
Threshold alpha=0.789, β=0.375 is obtained by above-mentioned loss function.There is lower FRR if necessary, then setting
Set bigger λNP, i.e. λPP=0, λPN=9, λBP=4, λBN=3, λNP=18, λNN=0.
The FRR of random forest and FAR are compared, as shown in table 4.
The FRR and FAR of 4 random forest of table compare
| Random forest | FAR | FRR | Average time (second) |
| Single behaviour decision making | 3.32% | 4.29% | 8.85 |
| Three decisions (α=0.789, β=0.375) | 1.01% | 2.95% | 9.87 |
| Three decisions (α=0.6, β=0.375) | 1.61% | 2.81% | 9.87 |
| Three decisions (α=0.6, β=0.176) | 1.73% | 1.81% | 9.87 |
| Two behaviour decision makings | 1.06% | 1.72% | 17.7 |
It can be seen that in less authenticated time, the present invention can obtain with authenticated using the more time similar in
Performance, by adjusting loss function, the performance indicator (such as FAR or FRR) that the present invention can be made to be more concerned about reaches very close
Using more time decision performance even more preferably performance (such as threshold value is α=0.789, when β=0.375, three decisions
FAR is 1.01%, and two behaviour decision makings are 1.06%, and threshold value is α=0.6, and when β=0.176, the FRR of three decisions is
1.81%, 1.72%) FRR of two behaviour decision makings is.
If present model selects threshold alpha=0.6, β=0.375, mouse message is collected to a legal mouse user, is collected
To the data (listing partial data) in behavioral data sequence such as table 5 and table 6.According to being a PC behavior representation in definition table 5
For A1, feature is extracted, is put into model and detects verifying, available output score is 0.4, and the data in table 6 are according to w is defined
One MM behavior representation is A2, extracts feature, is put into model and detects verifying, and available output score is 0.9.
The mouse data of 5 one PC behaviors of table
The mouse data of 6 one MM behaviors of table
| Timestamp | Key | State | X coordinate | Y-coordinate |
| 0 | NoButton | Move | 273 | 662 |
| 0.031 | NoButton | Move | 277 | 652 |
| 0.047 | NoButton | Move | 282 | 640 |
| 0.062 | NoButton | Move | 289 | 629 |
| 0.078 | NoButton | Move | 297 | 615 |
| 0.109 | NoButton | Move | 310 | 592 |
| 0.109 | NoButton | Move | 319 | 582 |
| … | … | … | … | … |
| 8.081 | NoButton | Move | 547 | 237 |
| 8.096 | NoButton | Move | 548 | 236 |
| 8.112 | NoButton | Move | 549 | 235 |
| 8.268 | NoButton | Move | 549 | 234 |
| 8.299 | NoButton | Move | 549 | 233 |
| 8.33 | NoButton | Move | 549 | 232 |
Method one: if authenticated using a behavioral data, it will will be judged as illegal mouse user according to A1
(at this time for two classify only one threshold value be 0.5), legal mouse user will be judged as according to A2.
Method two: if using A1, A2 is authenticated simultaneously, and regardless of A1 and A2, who is first collected into, and is all 0.65 by obtained score
It can correctly be judged as legal mouse user, but the time used is about two times in method one.
Method three: three authentications i.e. proposed by the invention belong to need according to threshold decision if being collected into A1 first
The mouse user for wanting Delayed Decision, is collected into A2, and using two behavioral datas, decision score is 0.65 simultaneously, is judged as legal mouse
Mark user.If being collected into A2 first, score is judged as legal mouse user for 0.9.Therefore very determining mouse can be used
Family extracts decision and reduces expectation authenticated time, for available higher accurate in uncertain mouse user Delayed Decision
Rate.
To avoid repeating, the individual features between above method, system embodiment can be quoted mutually.
Those of ordinary skill in the art will appreciate that all or part of the steps in the various methods of above-described embodiment is can
It is completed with instructing relevant hardware by program, which can be stored in a computer readable storage medium, storage
Medium may include: ROM, RAM, disk or CD etc..
Embodiment provided above has carried out further detailed description, institute to the object, technical solutions and advantages of the present invention
It should be understood that embodiment provided above is only the preferred embodiment of the present invention, be not intended to limit the invention, it is all
Any modification, equivalent substitution, improvement and etc. made for the present invention, should be included in the present invention within the spirit and principles in the present invention
Protection scope within.
Claims (8)
1. a kind of three based on mouse behavior identity identifying method, the described method comprises the following steps:
Step 1 carries out mouse data acquisition, and acquisition t moment includes the position of timestamp, key, state and pointer in screen
Five-tuple mouse action (the t sets,bs,ss,xs,ys)t；And duplicate removal processing is carried out to the data after acquisition and goes abnormality processing；
tsIndicate the timestamp in point s, bsIndicate the key in point s, ssIndicate the state in point s, xsAnd ysIndicate horizontal in the mouse of point s
Ordinate；
Step 2, the data sequence being made of multiple basic mouse actions calculate special as a mouse behavior according to mouse behavior
Vector is levied, to calculate relevant characteristic value；
It is characterized in that,
Step 3 constructs Random Forest model based on mouse features, and the prediction for obtaining sample object by the Random Forest model is general
Rate；
Prediction probability is inputted three Model of Identity Authentication System by step 4；Be calculated by loss function classify it is required just
Domain threshold alpha and negative domain threshold value beta, sample object is divided in positive domain, Boundary Region or negative domain；The sample object of negative domain is determined as
Illegal mouse user, is determined as legal mouse user for the sample object in positive domain, the sample object of Boundary Region is continued to recognize
Card.
2. a kind of three based on mouse behavior identity identifying method according to claim 1, which is characterized in that the mouse
Mark behavior includes:
Moving distance S: the path length that mouse behavior is moved from starting point to end point is indicated；
Time Δ T: time used in indicating mouse behavior from starting point to end point；
Movement speed vk: indicate the movement speed between two mouse actions；
Translational acceleration ak: indicate the translational acceleration between two mouse actions；
Mobile acceleration jerkk: indicate the mobile acceleration between two mouse actions；
Move angle θk: indicate the angle of two mouse action motion tracks；
Mobile angular speed wk: indicate the angular speed of two mouse action motion tracks；
Curvature ck: indicate the curvature of two mouse action motion tracks；
Straightness st: the flatness of mouse sequence starting point to end point.
3. a kind of three based on mouse behavior identity identifying method according to claim 1, which is characterized in that three bodies
The probability of part authentication model input are as follows:
Wherein, P (C | X) indicates that object x belongs to the conditional probability of classification C；N indicates the trees tree in random forest；PiIndicate the
The prediction probability of i tree.
4. a kind of three based on mouse behavior identity identifying method according to claim 1, which is characterized in that pass through damage
Losing the calculated positive domain threshold alpha of function and negative domain threshold value beta indicates are as follows:
Wherein, λPPIndicate the loss that legal mouse user is determined as to legal mouse user, λPNLegal mouse user is sentenced in expression
It is set to the loss of illegal mouse user, λBPIndicate the loss that Delayed Decision mouse user is determined as to legal mouse user, λBN
Indicate the loss that illegal mouse user is determined as to Delayed Decision mouse user, λNPIt is legal that illegal mouse user is determined as by expression
The loss of mouse user, λNNIndicate the loss that illegal mouse user is determined as to illegal mouse user.
5. a kind of three based on mouse behavior identity authorization system, which is characterized in that the system comprises be successively electrically connected
Mouse data acquisition module, behavior characteristic extraction module, three Model of Identity Authentication System building modules and identity detect decision
Module；
The mouse data acquisition module carries out duplicate removal processing to the data after acquisition and goes for carrying out mouse data acquisition
Abnormality processing；
The behavior characteristic extraction module is used to the processed mouse data of mouse data acquisition module being combined into mouse user
Mouse behavior, and calculate each characteristic value of mouse behavior；
Three Model of Identity Authentication System building module is used to obtain behavior characteristic extraction module mouse features model and obtain
Model is obtained, sample object is divided in positive domain, Boundary Region or negative domain；
The identity detection decision-making module is used to authenticate sample object by three Model of Identity Authentication System, including judges sample
This object is legal mouse user or illegal mouse user or Delayed Decision mouse user.
6. a kind of three based on mouse behavior identity authorization system according to claim 5, which is characterized in that described three
It includes random forest unit, loss function unit, threshold cell and behavioural characteristic unit that branch Model of Identity Authentication System, which constructs module,；
The random forest unit is used to export the prediction probability of sample object；The loss function unit is for constructing loss function；
The threshold cell is used to generate positive domain threshold value and negative domain threshold value according to loss function；The behavioural characteristic unit is for determining mouse
Mark the behavior of user.
7. a kind of three based on mouse behavior identity authorization system according to claim 6, which is characterized in that it is described with
The probability of machine forest unit output, the i.e. probability of three Model of Identity Authentication System input are as follows:
Wherein, P (C | X) indicates that object x belongs to the conditional probability of classification C；N indicates the trees tree in random forest；PiIndicate the
The prediction probability of i tree.
8. a kind of three based on mouse behavior identity authorization system according to claim 6, which is characterized in that loss letter
Counting unit calculates positive domain threshold value and negative domain threshold value by loss function, indicates are as follows:
Wherein, λPPIndicate the loss that legal mouse user is determined as to legal mouse user, λPNIllegal mouse user is sentenced in expression
It is set to the loss of legal mouse user, λBPIndicate the loss that legal mouse user is determined as to Delayed Decision mouse user, λBNTable
Show the loss that illegal mouse user is determined as to Delayed Decision mouse user, λNPIt indicates legal mouse user being determined as illegal mouse
Mark the loss of user, λNNIndicate the loss that illegal mouse user is determined as to illegal mouse user.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910191823.XA CN109871676A (en) | 2019-03-14 | 2019-03-14 | Three identity identifying methods and system based on mouse behavior |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910191823.XA CN109871676A (en) | 2019-03-14 | 2019-03-14 | Three identity identifying methods and system based on mouse behavior |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN109871676A true CN109871676A (en) | 2019-06-11 |
Family
ID=66920537
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910191823.XA Pending CN109871676A (en) | 2019-03-14 | 2019-03-14 | Three identity identifying methods and system based on mouse behavior |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109871676A (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111144910A (en) * | 2019-12-28 | 2020-05-12 | 重庆邮电大学 | Method and device for recommending crime tendering and bidding objects based on fuzzy entropy mean shadow set |
| CN112396445A (en) * | 2019-08-16 | 2021-02-23 | 京东数字科技控股有限公司 | Method and device for identifying user identity information |
| CN112684920A (en) * | 2020-12-31 | 2021-04-20 | 广州市博大电子设备有限公司 | Self-adaptive adjusting method of mouse DPI and application thereof |
| CN112717418A (en) * | 2021-01-19 | 2021-04-30 | 王怡 | Online game login system and method based on big data |
| CN112949690A (en) * | 2021-02-02 | 2021-06-11 | 重庆大学 | Continuous identity authentication method based on mouse behavior time-frequency joint analysis |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101833619A (en) * | 2010-04-29 | 2010-09-15 | 西安交通大学 | Method for judging identity based on keyboard-mouse crossed certification |
| CN103530546A (en) * | 2013-10-25 | 2014-01-22 | 东北大学 | Identity authentication method based on mouse behaviors of user |
-
2019
- 2019-03-14 CN CN201910191823.XA patent/CN109871676A/en active Pending
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101833619A (en) * | 2010-04-29 | 2010-09-15 | 西安交通大学 | Method for judging identity based on keyboard-mouse crossed certification |
| CN103530546A (en) * | 2013-10-25 | 2014-01-22 | 东北大学 | Identity authentication method based on mouse behaviors of user |
Non-Patent Citations (2)
| Title |
|---|
| HENG-RUZHANG等: "《Three-way recommender systems based on random forests》", 《KNOWLEDGE-BASED SYSTEMS》 * |
| 徐剑等: "《基于用户鼠标行为的身份认证方法》", 《计算机科学》 * |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112396445A (en) * | 2019-08-16 | 2021-02-23 | 京东数字科技控股有限公司 | Method and device for identifying user identity information |
| CN111144910A (en) * | 2019-12-28 | 2020-05-12 | 重庆邮电大学 | Method and device for recommending crime tendering and bidding objects based on fuzzy entropy mean shadow set |
| CN111144910B (en) * | 2019-12-28 | 2022-11-15 | 重庆邮电大学 | Bidding 'series bid, companion bid' object recommendation method and device based on fuzzy entropy mean shadow album |
| CN112684920A (en) * | 2020-12-31 | 2021-04-20 | 广州市博大电子设备有限公司 | Self-adaptive adjusting method of mouse DPI and application thereof |
| CN112684920B (en) * | 2020-12-31 | 2022-03-08 | 广州竟成塑胶模具有限公司 | Self-adaptive adjusting method of mouse DPI and application thereof |
| CN112717418A (en) * | 2021-01-19 | 2021-04-30 | 王怡 | Online game login system and method based on big data |
| CN112949690A (en) * | 2021-02-02 | 2021-06-11 | 重庆大学 | Continuous identity authentication method based on mouse behavior time-frequency joint analysis |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109871676A (en) | Three identity identifying methods and system based on mouse behavior | |
| CN109325691B (en) | Abnormal behavior analysis method, electronic device and computer program product | |
| Hartson et al. | Criteria for evaluating usability evaluation methods | |
| CN109034194B (en) | Transaction fraud behavior deep detection method based on feature differentiation | |
| WO2016049983A1 (en) | User keyboard key-pressing behavior mode modeling and analysis system, and identity recognition method thereof | |
| CN105677791B (en) | For analyzing the method and system of the operation data of wind power generating set | |
| KR20190032495A (en) | METHOD AND DEVICE FOR MODELING EVALUATION MODELS | |
| CN105389486B (en) | A kind of authentication method based on mouse behavior | |
| Reger et al. | A pattern-based approach to parametric specification mining | |
| CN108268886B (en) | Method and system for identifying plug-in operation | |
| CN112329816A (en) | Data classification method and device, electronic equipment and readable storage medium | |
| CN111047173B (en) | Community credibility evaluation method based on improved D-S evidence theory | |
| CN111160329A (en) | Root cause analysis method and device | |
| CN114638688A (en) | Interception strategy derivation method and system for credit anti-fraud | |
| TWI677830B (en) | Method and device for detecting key variables in a model | |
| Shen et al. | A hypo-optimum feature selection strategy for mouse dynamics in continuous identity authentication and monitoring | |
| Al-Khazzar et al. | Graphical authentication based on user behaviour | |
| CN105824785A (en) | Rapid abnormal point detection method based on penalized regression | |
| CN113722230B (en) | Integrated evaluation method and device for vulnerability mining capability of fuzzy test tool | |
| Eastwood et al. | Technology gap navigator: Emerging design of biometric-enabled risk assessment machines | |
| CN113792141A (en) | Feature selection method based on covariance measurement factor | |
| CN107403199A (en) | Data processing method and device | |
| Chen et al. | On top-$ k $ selection from $ m $-wise partial rankings via borda counting | |
| Eliades et al. | A betting function for addressing concept drift with conformal martingales | |
| Jung et al. | Combining CNNs for detecting pornography in the absence of labeled training data |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20190611 |
|
| RJ01 | Rejection of invention patent application after publication |