WO2017075913A1 - Mouse behaviors based authentication method - Google Patents

Abstract

The present invention provides an authentication method based on mouse behaviors. The mouse-based authentication method comprises: collecting the mouse behavior data generated in the process of inputting passwords by the preset user by using the dynamic soft keyboard; calculating with the mouse behavior data to obtain the eigenvalue and selecting the optimal eigenvector by the feature selection algorithm; processing the optimal eigenvector using a preset model to determine a user behavior pattern of the user. The mouse-based authentication method further comprises: receiving the mouse behavior data generated in the process of inputting the passwords by using the dynamic soft keyboard, and performing user identification classifying authentication for the received mouse behavior data according to the user behavior pattern. The technical solution of the present invention is especially suitable for use under the dynamic soft keyboard application scenario as an auxiliary means for the traditional user name/password authentication mechanism.

Description

A mouse behavior based authentication method Technical field

The invention relates to a security technology, in particular to a mouse behavior based authentication method.

Background technique

With the popularity of e-commerce, online banking and online electronic payment are gradually accepted and loved by netizens. However, the security of these payment platforms is not optimistic, identity theft phenomenon occurs frequently, and credibility issues are widely concerned. Secure identity authentication has become the basic premise for ensuring the security of electronic transactions. In order to prevent password theft, some online banking and e-commerce payment platforms use technical methods such as security controls, hardware assistance, and dynamic soft keyboards. Among them, the so-called soft keyboard is not on the keyboard, but on the "screen", the soft keyboard is a character input through the software simulation keyboard through the mouse click, in order to prevent the password input by the Trojan record keyboard, generally in some bank websites The place where you need to enter your account number and password is easy to see. The dynamic soft keyboard protects against attacks such as keyloggers, spyware, and malicious machine registration; however, it does not prevent Trojans with screenshots and shoulder-slung behavior.

In view of this, how to improve the security of identity authentication through a dynamic soft keyboard has become an urgent problem to be solved by those skilled in the art.

Summary of the invention

In view of the above disadvantages of the prior art, an object of the present invention is to provide a mouse behavior based authentication method for solving the security problem existing in the prior art dynamic soft keyboard technology.

To achieve the above and other related purposes, the present invention provides a mouse behavior-based authentication method, the mouse-based authentication method includes: collecting mouse behavior data during a process of inputting a password by using a dynamic soft keyboard by a preset user; The mouse behavior data is calculated and processed to obtain the feature value, and the feature selection algorithm is used to select the optimal feature vector; the optimal feature vector is processed by the preset model to determine the user behavior mode of the user.

Optionally, the mouse-based authentication method further includes: receiving mouse behavior data during a password input process using a dynamic soft keyboard, and performing user identity classification authentication on the received mouse behavior data according to the user behavior mode.

Optionally, the specific implementation of performing user identity classification and authentication on the received mouse behavior data according to the user behavior mode includes: combining the user behavior pattern, and processing the received mouse behavior data by using a K majority vote method, Thereby determining whether to pass the certification.

Optionally, the dynamic soft keyboard comprises a randomly generated out-of-order keyboard.

Optionally, the feature selection algorithm includes an L-to-R selection algorithm.

Optionally, the feature value includes at least one of a keystroke entry speed, a keystroke departure speed, and a keying time.

Optionally, the feature value further includes a moving speed, an acceleration, and a moving angle value.

Optionally, the preset model includes a support vector machine model.

Optionally, processing the optimal feature vector by using a preset model, and determining a specific implementation of the user behavior mode includes: normalizing the optimal feature vector; and uniformly, the optimal feature vector Divided into a plurality of sets of subset data, for each set of subset data, the subset data is used as a verification set, and other subset data is used as a training set to obtain a model parameter and a classifier performance index respectively; The model parameters corresponding to the maximum values in the classifier performance indicators determine the user behavior pattern.

As described above, the mouse behavior-based authentication method of the present invention has the following beneficial effects: user identity authentication when the mouse action is a non-fixed track can be realized. In the process of construction and certification, new feature value keystroke entry speed, keystroke departure speed, keystroke time, etc. are used to refine the traditional feature values and improve the authentication accuracy. The technical solution of the present invention is particularly suitable for use in a dynamic soft keyboard application scenario as an auxiliary means of a traditional username/password authentication mechanism.

DRAWINGS

FIG. 1 is a flow chart showing an embodiment of a mouse behavior based authentication method according to the present invention.

2 is a flow chart showing another embodiment of the mouse behavior based authentication method of the present invention.

Component label description

S1 ~ S4 steps

detailed description

The embodiments of the present invention are described below by way of specific examples, and those skilled in the art can readily understand other advantages and effects of the present invention from the disclosure of the present disclosure. The present invention may be embodied or applied in various other specific embodiments, and various modifications and changes can be made without departing from the spirit and scope of the invention.

It should be noted that the illustrations provided in the present embodiment merely illustrate the basic concept of the present invention in a schematic manner, and only the components related to the present invention are shown in the drawings, instead of the number and shape of components in actual implementation. Dimensional drawing, the actual type of implementation of each component's type, number and proportion can be a random change, and its component layout can be more complicated.

The invention provides a mouse behavior based authentication method, which is particularly suitable for use in a dynamic soft keyboard application scenario. In one embodiment, as shown in FIG. 1, the mouse-based authentication method includes:

In step S1, the mouse behavior data in the process of inputting the password by the preset user using the dynamic soft keyboard is collected. In one embodiment, the user-created dynamic soft keyboard is used to collect and store data generated by the mouse during the user input password operation when the user enters the password. For example, the existing open source software RUI tool is used to record the user's action data, and the recorded data tuple format is <t, x, y, action-type>. The data format is shown in the following table:

For a record tuple that does not conform to the rule, and a record tuple whose data size is obviously abnormal, it can be deleted and not used as mouse behavior data. The dynamic soft keyboard includes a randomly generated out-of-order keyboard. The use of randomly generated out-of-order keyboards can improve the security of authentication.

In step S2, the mouse behavior data is calculated and processed to obtain feature values, and the feature selection algorithm is used to select the best feature vector. For the design of eigenvectors (the eigenvectors are composed of eigenvalues), considering the dynamic soft keyboard application scenario, analyzing the characteristics of the mouse data, it is found that the two actions of the user to operate the mouse to find the target key and leave the target key constitute the main behavior trajectory. Therefore, two types of behaviors such as keystrokes and keystrokes are defined. Keystroke behavior refers to the behavior of a user operating a mouse to click a character key on a soft keyboard. The key-seeking behavior refers to the behavior of the user operating the mouse to find a character key on the soft keyboard. On this basis, a series of new eigenvalues such as entry speed, exit speed, and key-to-key time ratio are defined, which are supplemented by traditional eigenvalues (such as average speed, acceleration, deviation distance, etc.). The entry speed is recorded as V _in , which is defined as the speed at which the mouse enters a button before the keystroke begins. The exit speed is recorded as V _out , defined as the speed at which the mouse leaves the key after the keystroke is over. Both the entry speed and the exit speed are calculated using the position information and duration of the 3 sample points before/after the click, and the duration is 3 sample periods. Since the duration is small, the mouse trajectory within the time interval can be approximated as a straight line for processing. In addition, considering that the same character segment exists in the key-in sequence, the ratio of the same character key-finding time to Rto is found, and the time of the same character in the same character segment is found. Most of this value is less than one due to the influence of human memory. In one embodiment, optionally, the feature value includes at least one of a keystroke entry speed, a keystroke departure speed, and a keying time. The feature values may also include moving speed, acceleration, moving angle values, and the like. In one embodiment, the eigenvalues shown in the following table can be obtained by simple mathematical calculations.

The extraction of eigenvalues can be combined with the CDF cumulative function distribution and the incremental L-R feature selection method. The feature vector dimension is not as good as possible. The feature vector class without strong discrimination not only increases the detection workload, but also increases the false positive rate. In statistical probability, there is a CDF cumulative function distribution, which is used to describe the probability distribution of a real random variable, that is, the probability that the random variable is less than or equal to a certain value. By using the MATLAB tool to calculate the cumulative function distribution, visually compare the separability and stability of each eigenvalue, and select the eigenvalues with relatively scattered distribution, that is, the CDF curve coincidence rate is low.

In one embodiment, the feature selection algorithm includes an L-to-R selection algorithm. Add L to the R selection algorithm (LRS, Plus-L Minus-R Selection), there are two forms: <1> algorithm starts from the empty set, first adds L features in each round, then removes R features from it, so that the evaluation function The value is optimal. (L>R). <2> The algorithm starts from the complete set, and removes R features in each round, then adds L features to make the evaluation function value optimal. (L<R). Algorithm evaluation: The addition of L to R selection algorithm combines the idea of sequence forward selection and sequence backward selection. The choice of L and R is the key of the algorithm. In one embodiment, considering that the total dimension of all features is not large, the interval range of fixed L and R is [1, 8], and the values of L and R are determined within the range, and we enumerate the LR value, evaluation The function compares the classification accuracy with the classification accuracy, and finally selects the best feature vector. The best feature vector includes 9 types of feature values, which are 17-dimensional feature vectors. The composition of the feature vector is shown in the following table:

Numbering	Eigenvalues	meaning
1	CT	Click Time is the user click interval
2	CT max/min/mean/sd	CT maximum/minimum/average/standard deviation
3	ST	Search Time is the user's key-seeking time
4	ST max/min/median/sd	CT maximum / minimum / median / standard deviation
5	Rto	Repeat character key time ratio
6	T	Total duration
7	v in /v out	Entry speed at the time of keystroke, exit speed at the end of the keystroke
8	v in /v out(mean/sd)	Average/standard deviation of v in /v out
9	Deviation	Moving offset value

Step S3: processing the best feature vector by using a preset model to determine a user behavior mode of the user. Specifically, the optimal feature vector has a plurality of feature values. Processing the optimal feature vector by using a preset model, and determining the specific implementation of the user behavior mode comprises: normalizing the optimal feature vector; uniformly dividing the optimal feature vector into multiple groups Subset data, for each set of subset data, using the subset data as a verification set, and other subset data as a training set, respectively obtaining a model parameter and a classifier performance indicator; according to the plurality of classifier performance indicators The model parameters corresponding to the maximum value in the determination of the user behavior pattern. In one embodiment, the preset model includes a support vector machine model. Support Vector Machine (SVM) is a supervised learning model commonly used for pattern recognition, classification, and regression analysis. The user's mouse behavior characteristics are processed using the SVM support vector machine model. Including: normalizing the feature vector first, and normalizing the data to the [0,1] interval. In order to avoid the over-learning and under-learning state, the 5-CV cross-validation is used to select the penalty parameter c and the kernel function parameter g in the SVM algorithm to improve the classifier authentication accuracy. Specifically, the original training set is divided into 5 groups, each subset is made into a verification set, and the remaining 4 subsets are used as a training set to obtain 5 models, and the average of the classification accuracy of the final verification set is verified by 5 models. As a performance indicator of this 5-CV cross-validation classifier. The specific process of building a user behavior pattern is as follows:

Input: Mouse behavior data during the process of entering the password by the preset user using the dynamic soft keyboard Data={D ₁ , D ₂ , . . . , D _p }, D _i =<d _i1 ,d _i2 ,...,d _In >,i:1~p; where p is the number of samples collected and n is the eigenvector dimension, which means that one eigenvector is composed of n eigenvalues. The label Label = {L ₁ , L ₂ , ..., L _p }, L _i ∈ {+1, -1} is known. The penalty parameter range c∈[2^(-10), 2^10], the kernel function parameter range g∈[2^(-10), 2^10].

Output: best penalty parameter bestc, best kernel function parameter bestg.

step:

1) Using the formula f: x → y = (xx _min ) / (x _{max -} x _min ), the feature vector set is normalized by [0, 1]. Where x _min =min(x), x _max =max(x).

2) Use the RBF kernel function.

3) The feature vector set is evenly divided into 5 groups, and the following steps are repeated: one subset data is selected as the verification set, and the other 4 groups are used as the training set. In the given range of c and g, the interval value is step=2, and each is obtained. The average of the five classification accuracy corresponding to (c _j , g _j ) is taken as the classifier performance index Acc _j under this parameter.

4) Select the largest Acc _k =max{Acc _j }, then bestc=c _k , bestg=g _k .

For example, for convenience of description, the simplified feature vector is 3D, such as Data={D ₁ , D ₂ ,..., D ₅ }, and 5 samples are D ₁ =<1.1, 2.2, 3.0>, D ₂ =< 1.0, 2.1, 3.2>, D ₃ = <1.2, 2.0, 3.1>, D ₄ = <2.0, 2.9, 4.0>, D ₅ = <1.9, 3.0, 3.8>, Label={L ₁ , L ₂ ,... , L ₅ }, L ₁ = +1, L ₁ = +1, L ₁ = +1, L ₁ = -1, L ₁ = -1. Using normalization, we get Data'={D ₁ ', D ₂ ',..., D ₅ '}, D ₁ '=<0.1,0.2,0>, D ₂ '=<0,0.1,0.2>,D ₃ '=<0.2,0,0.1>, D ₄ '=<1,0.9, 1>, D ₅ '=<0.9,1,0.8>. According to the given range c∈[2^(-10), 2^10], g∈[2^(-10), 2^10], step=2, c _j and g _j respectively take {2^(- 10), 2^(-8),...,2^8,2^10}, for each pair (c _j , g _j ): Data' is divided into 5 groups, each D _i ' is a subset S _i Take any S _i as the verification set and the rest as the training set, and get the average performance index Acc _{j of the} corresponding parameter SVM classifier. Finally, max{Acc _j } is selected, and the corresponding (c _j , g _j ) is the parameter value of the required SVM.

In an embodiment, as shown in FIG. 2, the mouse-based authentication method further includes: step S4, receiving mouse behavior data during a password input process using a dynamic soft keyboard, and receiving the mouse according to the user behavior mode. Behavior data is used for user identity classification authentication. In one embodiment, the specific implementation of performing user identity classification and authentication on the received mouse behavior data according to the user behavior mode includes: combining the received user behavior data with the K majority vote method to perform the received mouse behavior data. Process to determine if it passes the certification. In one embodiment, the rule for classifying by majority vote is defined as: receiving mouse behavior data during the process of inputting a password using a dynamic soft keyboard, as the data to be tested, using the SVM classifier obtained by the above mode construction process for each The sample data is tested x times, and the classifier determines that it is a positive label more than k×x times (0.5<k≤1), then the sample is marked as a positive label, otherwise the label is a negative sample, which is called a k majority vote method. . In the experiment, the range of k is (0.5, 1), and the increment interval is 0.05, that is, k is {0.55, 0.60, ..., 0.95, 1.00} for authentication, and finally the best k value is obtained. In one embodiment, the authentication is as follows:

Receiving one or more mouse behavior data using a dynamic soft keyboard, and obtaining a corresponding optimal feature vector TestData={TD ₁ , TD ₂ , . . . , TD _q }, where TD _i =<td _i1 , td _i2 ,... ..., td _in >; where q is the number of mouse behavior data and n is the feature vector dimension (ie the number of feature values). SVM classifier parameter <bestc, bestg>; parameter k of the majority vote. Finally, the authentication result of each mouse behavior data is obtained Predicted_label={PL ₁ , PL ₂ , . . . , PL _p }, PL _i ∈{+1,-1}.

step:

1) Let the positive and negative label counters be initially 0, which are respectively recorded as: Num ₊₁ =0, Num _-1 =0.

2) Using x trained SVM classifiers <bestc, bestg>, respectively test the sample data x times: in each test, the feature vector TestData is used as the input of the SVM classifier, if the output of the classifier is PL _i = +1 , then Num ₊₁ ++; if PL _i = -1, then Num _-1 ++.

3) Judging the positive and negative label counter value: If Num ₊₁ ≥ k×x, the final value of PL _i is +1, indicating that the corresponding mouse behavior data is marked as a positive label by the user's authentication; otherwise, the final value of PL _i is -1, indicating that the corresponding mouse behavior data cannot be authenticated by the user and is marked as a negative sample.

In an embodiment, through repeated testing of the technical solution of the present invention, it is shown that the accuracy of the technical solution authentication can reach 97.33% on average. The majority of the votes are used for authentication, and the test data is used to verify the FAR and FRR values. Generally, the FRR (False Rejection Rate) and the FAR (False Acceptance Rate) are two main parameters used to evaluate the performance of the recognition algorithm. FRR is commonly known as the rejection rate. The standard name is FNMR (False Non-Match Rate). No match rate). It can be understood in a common sense as the probability that "the fingerprints that should match each other successfully should be regarded as fingerprints that cannot be matched". FAR is generally called the false rate, and its standard name is FMR (False Match Rate). FMR is the most important parameter used to evaluate the performance of fingerprint recognition algorithms. It can be commonly understood as the probability of "putting a fingerprint that should not be matched as a matching fingerprint." In one embodiment, a comparison is made between the use of new feature values (including a series of new feature values such as entry speed, exit speed, key-to-key ratio, etc.) and the use of new feature values. The results show that the FAR and FRR values decrease after adding new eigenvalues, which means that the authentication effect is improved.

In summary, the mouse behavior-based authentication method of the present invention can implement user identity authentication when the mouse action is a non-fixed track. In the process of construction and certification, new feature value keystroke entry speed, keystroke departure speed, keystroke time, etc. are used to refine the traditional feature values and improve the authentication accuracy. The technical solution of the present invention is particularly suitable for use in a dynamic soft keyboard application scenario as an auxiliary means of a traditional username/password authentication mechanism. Therefore, the present invention effectively overcomes various shortcomings in the prior art and has high industrial utilization value.

The above-described embodiments are merely illustrative of the principles of the invention and its effects, and are not intended to limit the invention. Modifications or variations of the above-described embodiments may be made by those skilled in the art without departing from the spirit and scope of the invention. Therefore, all equivalent modifications or changes made by those skilled in the art without departing from the spirit and scope of the invention will be covered by the appended claims.

Claims (9)

1. A mouse behavior based authentication method, characterized in that the mouse-based authentication method comprises:

   Collecting mouse behavior data during the process of inputting a password by a preset user using a dynamic soft keyboard;

   Performing calculation processing on the mouse behavior data to obtain feature values, and selecting a best feature vector by using a feature selection algorithm;

   The best feature vector is processed by using a preset model to determine a user behavior pattern of the user.
2. The mouse behavior-based authentication method according to claim 1, wherein the mouse-based authentication method further comprises: receiving mouse behavior data during a process of inputting a password by using a dynamic soft keyboard, according to the user behavior mode Received mouse behavior data for user identity classification authentication.
3. The mouse behavior-based authentication method according to claim 2, wherein the specific implementation of performing user identity classification and authentication on the received mouse behavior data according to the user behavior pattern comprises: combining the user behavior pattern with K Most ticket resolutions process the received mouse behavior data to determine whether or not to pass the authentication.
4. The mouse behavior-based authentication method according to claim 1 or 2, wherein the feature value comprises at least one of a keystroke entry speed, a keystroke departure speed, and a key-seeking time.
5. The mouse behavior-based authentication method according to claim 4, wherein the feature value further comprises a moving speed, an acceleration, and a moving angle value.
6. The mouse behavior-based authentication method according to claim 1 or 2, wherein the dynamic soft keyboard comprises a randomly generated out-of-order keyboard.
7. The mouse behavior-based authentication method according to claim 1 or 2, wherein the feature selection algorithm comprises an L-to-R selection algorithm.
8. The mouse behavior-based authentication method according to claim 1 or 2, wherein the preset model comprises a support vector machine model.
9. The mouse behavior-based authentication method according to claim 8, wherein the optimal model is used for the best The feature vector is processed, and the specific implementation of determining the user behavior mode comprises: normalizing the optimal feature vector; uniformly dividing the optimal feature vector into multiple sets of subset data, for each group The data is collected, the subset data is used as a verification set, and the other subset data is used as a training set to obtain a model parameter and a classifier performance index respectively; according to the obtained maximum value of the plurality of classifier performance indicators The parameters determine the user behavior pattern.

Images