陈楠 田立勤 毋泽南 张艺 武文星

摘 要：随着网络信息安全技术的不断发展，行为认证已成为身份验证研究的重要内容之一。针对传统用户行为认证方法中由于行为信息量过多而导致的认证时间过长问题，提出了一种基于三支决策的用户访问行为认证方法。该方法首先通过三支决策对获取的部分行为特征进行预先认证，将待检测用户认定为合法用户、延迟决策用户和非法用户三个类别，再通过二支决策方法对继续获取行为特征的延迟决策用户进行进一步认证，在提高认证实时性的同时，克服了认证过程中由于特征不足而导致的不确定性问题，从而保证行为认证结果的准确性。实验结果表明，该方法能够取得较好的认证效果并有效降低认证时间。

关键词：访问行为;行为特征;三支决策;用户行为认证;访问信息安全

中图分类号：TP309 文献标识码：A DOI：10.3969/j.issn.1003-6970.2021.02.001

本文著录格式：陈楠，田立勤，毋泽南，等.基于三支决策的用户访问行为认证方法研究[J].软件，2021，42（02）：001-005+027

Research on User Access Behavior Authentication Method Based on Three Decisions

CHEN Nan1， TIAN Liqin1，2， WU Zenan2， ZHANG Yi1， WU Wenxing1

（1.School of Computer， North China Institute of Science and Technology， Beijing  065201;

2.School of Computer， Qinghai Normal University， Xining  Qinghai  810000）

【Abstract】：With the continuous development of network information security technology， behavior authentication has become one of the important contents of identity verification research. Aiming at the problem of too long authentication time due to the excessive amount of behavior information in traditional user behavior authentication methods， a user access behavior authentication method based on three decisions is proposed. This method first pre-authenticates some of the acquired behavior characteristics through three decision-making methods， and recognizes the users to be detected as legitimate users， delayed decision-making users， and illegal users， and then uses two decision-making methods to determine the delayed decision to continue acquiring behavior characteristics. The user performs further authentication， which not only improves the real-time of authentication， but also overcomes the uncertainty problem caused by insufficient features in the authentication process， thereby ensuring the accuracy of the behavior authentication result. Experimental results show that this method can achieve better certification results and effectively reduce certification time.

【Key words】：access behavior;behavior characteristics;three decision-making;user behavior authentication; access information security

0引言

隨着互联网信息技术的快速发展，电子商务、互联网金融和工业信息化等各个领域都获得了前所未有的创新力和推动力。人们在享受互联网技术带来便利的同时，网络应用和服务信息访问的安全问题也变得日益严峻[1-3]。

身份认证是保障网络信息安全服务的基础，现行主流的身份认证手段包括基于密钥的身份认证和基于生物学特征的身份认证，但传统的静态身份认证方法无法保障企业或个人因信息泄露而导致的敏感数据丢失和恶意利用的问题[4]。……