Canvas fingerprint user behavior identification and tracking method

Abstract

The invention discloses a Canvas fingerprint user behavior identification and tracking method, which relates to the technical field of data processing, and comprises the following steps of: A1, firstly, acquiring dynamic operation information of a program through an information acquisition unit, acquiring equipment fingerprints, and collecting information such as malicious mobile phone numbers, mailboxes, IPs (Internet Protocol) and behaviors; a2, carrying out data preprocessing and extraction through a data extraction unit based on the collected data; and A3, analyzing and confirming abnormal behaviors of the extracted data through a data analysis unit in a soft probe mode under the condition of not changing page source codes, and distributing unique identity tokens as user marks to all visitor terminal devices accessing the data by utilizing a multi-dimensional fingerprint acquisition technology, if a data visitor accesses a database in a web mode, a request of the visitor can be converted into a complete SQL statement, and metadata is provided for next data protection auditing and hacker attack behavior analysis.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a Canvas fingerprint user behavior recognition and tracking method. Background Art

[0002] Canvas is a dynamic drawing tag in HTML5, which can be used to generate and even process advanced images. Based on Canvas, draw pictures with specific content, and use the canvas method to return the base64 encoded string of the image content. For the PNG file format, it is divided into chunks, and the last chunk is a 32-bit CRC checksum. Extracting this CRC checksum can be used to uniquely identify the user. Fundamentally, each browser uses a different image processing engine, different export options, and different compression levels, so the graphics drawn by each computer will be slightly different. These patterns can be used to assign specific numbers (fingerprints) to user devices, that is, they can be used to identify different users.

[0003] According to the patent title: A method and platform for tracking the behavior of network users (patent publication number: CN107995289A, patent publication date: 2018-05-04), it includes: judging whether the user access traffic of the website within a set time period is greater than or equal to the monitoring threshold, and if it is judged that the user access traffic is greater than or equal to the monitoring threshold, then classifying and tracking the users according to the pre-generated valid user data set corresponding to the website. This method can find the source of group behavior of network users, track network users in real time and accurately, and effectively improve network security.

[0004] Based on the above-mentioned prior art, the existing Canvas fingerprint user behavior identification and tracking method still has the following problems: with the advancement of the construction of new power systems, there are many types of terminal devices, which have generated massive heterogeneous data. Relying on traditional database protection solutions based on traffic analysis can no longer meet the protection needs of massive data. There are problems such as insufficient concurrent processing capabilities and difficulty in supporting big data analysis, which leads to performance bottlenecks in database auditing and makes it difficult to cope with the new situation of explosive growth in data scale. To this end, the present invention provides a Canvas fingerprint user behavior identification and tracking method. Summary of the invention

[0005] In view of the shortcomings of the prior art, the present invention provides a Canvas fingerprint user behavior identification and tracking method, which solves the problem of promoting the construction of a new power system. At present, there are many types of terminal devices, which generate massive heterogeneous data. Relying on traditional database protection solutions based on traffic analysis can no longer meet the protection needs of massive data. There are problems such as insufficient concurrent processing capabilities and difficulty in supporting big data analysis, which leads to performance bottlenecks in database auditing and makes it difficult to cope with the new situation of explosive growth in data scale.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: A Canvas fingerprint user behavior recognition, specifically comprising the following steps:

[0007] A1. First, the information acquisition unit obtains the program dynamic operation information, device fingerprints, and collects malicious mobile phone numbers, email addresses, IP addresses, behaviors, and other information;

[0008] A2, preprocessing and extracting data through a data extraction unit based on the collected data;

[0009] A3. The extracted data is analyzed and confirmed by the data analysis unit for abnormal behavior;

[0010] A4. The analyzed data is displayed in the result display unit to show the user's identity and behavior.

[0011] Preferably, the output end of the information acquisition unit is connected to the input end of the data extraction unit, the output end of the data extraction unit is connected to the input end of the data analysis unit, the output end of the data analysis unit is connected to the input end of the result display unit, and the information acquisition unit includes a non-invasive soft probe module, a multi-dimensional fingerprint acquisition module and a business threat intelligence module.

[0012] Preferably, the data extraction unit includes a data preprocessing module, a browser script deployment module, a browser script execution module, a feature information extraction module, a browser fingerprint generation module and a data storage module.

[0013] Preferably, the data analysis unit includes a correlation analysis model and an abnormal behavior analysis model.

[0014] Preferably, the core technology of the non-intrusive soft probe module adopts bytecode instrumentation technology, which collects the running status of the program at a certain moment during the execution process through instrumentation.

[0015] Preferably, the association analysis model combines static rules with LSTM, and adds SQL syntax analysis technology.

[0016] Preferably, the abnormal behavior analysis model includes models such as abnormal login device fingerprint anomaly, frequent login, brute force cracking, sensitive configuration item operation, remote login, abnormal access, high-frequency operation, cross-regional operation, sensitive behavior operation, sensitive keyword operation, special ultra-low frequency operation, special permission operation, and data export operation.

[0017] Preferably, the abnormal behavior analysis model training method is: forward model training (forward deduction method) and reverse model training (reverse mining method).

[0018] The present invention provides a Canvas fingerprint user behavior recognition and tracking method. Compared with the prior art, it has the following beneficial effects:

[0019] 1. The Canvas fingerprint user behavior identification and tracking method is implemented through soft probes without changing the page source code. It uses multi-dimensional fingerprint acquisition technology to assign unique identity tokens as user tags to all terminal devices that access data. For example, if a data visitor accesses the database through the web, the visitor's request can be converted into a complete SQL statement, providing metadata for the next step of data protection auditing and hacker attack behavior analysis.

[0020] 2. The Canvas fingerprint user behavior identification and tracking method uses SQL semantic analysis technology to achieve low false positive data auditing. Each data platform security strategy is intelligently tailored to effectively prevent SQL injection, database dragging and database collision and other database attack behaviors, capture and parse the local operation behavior of the database, and achieve the same-machine audit of the application and database. Through the accurate correlation analysis of SQL behavior and business users, the database access behavior can be effectively located to the business staff, and the full amount of database behavior records can be formed based on risks, statements, sessions, clients, applications, response time, response results, etc., for effective tracing and accountability;

[0021] 3. The Canvas fingerprint user behavior identification and tracking method uses big data analysis technology to detect potential abnormal behaviors in data access, and has deeper analysis and mining in the entire data protection life cycle. Some of its functions also combine machine learning intelligent analysis methods, which can make dynamic judgments on normal users and malicious hacker behavior analysis, making up for the shortcomings of traditional data security protection solutions that cannot defend against new data attacks such as order brushing, database collision and wool pulling. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 is a block diagram of the method of the present invention;

[0023] Figure 2 is a system block diagram of the present invention;

[0024] Figure 3 It is a block diagram of the information acquisition unit of the present invention;

[0025] Figure 4 It is a block diagram of a data extraction unit of the present invention;

[0026] Figure 5 is a block diagram of a data analysis unit of the present invention;

[0027] Figure 6 It is a block diagram of the abnormal behavior analysis model of the present invention;

[0028] Figure 7 It is a block diagram of the association model of the present invention;

[0029] Figure 8 It is a schematic diagram of the syntax analysis of the present invention;

[0030] Fig. 9 It is a program instrumentation flow chart of the present invention;

[0031] Fig.10 It is the browser script flow chart of the present invention.

[0032] In the figure: 1-information acquisition unit, 11-non-intrusive soft probe module, 12-multi-dimensional fingerprint acquisition module, 13-business threat intelligence module, 2-data extraction unit, 21-data preprocessing module, 22-browser script deployment module, 23-browser script execution module, 24-feature information extraction module, 25-browser fingerprint generation module, 26-data storage module, 3-data analysis unit, 31-correlation analysis model, 32-abnormal behavior analysis model, 4-result display unit 4. DETAILED DESCRIPTION

[0033] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0034] See also Figure 1-10 , the present invention provides a technical solution:

[0035] A Canvas fingerprint user behavior recognition method includes the following steps:

[0036] A1. First, the information acquisition unit 1 obtains the program dynamic operation information, the device fingerprint, and the malicious mobile phone number, email address, IP address, behavior and other information;

[0037] A2, preprocessing and extracting data through data extraction unit 2 based on the collected data;

[0038] A3, the extracted data is analyzed and confirmed by the data analysis unit 3 for abnormal behavior;

[0039] A4. The analyzed data is displayed in result display unit 4 to show the user identity and behavior.

[0040] In this embodiment, the output end of the information acquisition unit 1 is connected to the input end of the data extraction unit 2, the output end of the data extraction unit 2 is connected to the input end of the data analysis unit 3, the output end of the data analysis unit 3 is connected to the input end of the result display unit 4, and the information acquisition unit 1 includes a non-invasive soft probe module 11, a multi-dimensional fingerprint acquisition module 12 and a business threat intelligence module 13.

[0041] In this embodiment, the data extraction unit 2 includes a data preprocessing module 21 , a browser script deployment module 22 , a browser script execution module 23 , a feature information extraction module 24 , a browser fingerprint generation module 25 and a data storage module 26 .

[0042] The data preprocessing module 21 is mainly responsible for data deduplication, data cleaning, data preprocessing and receiving information submitted by the non-intrusive soft probe;

[0043] The browser script deployment module 22 deploys the browser script with information extraction function on an accessible server, such as a public network server or a local server, to provide a link to the JS code file;

[0044] Browser script execution module 23: embeds the deployed browser script link into the target HTML page through the tag, and downloads and executes the external JS file according to the link when the page is rendered;

[0045] Feature information extraction module 24: Once the browser script is executed on the visitor's device, it can play the role of feature information extraction, extracting the user's browser features, operating system features, device hardware features, user settings features and network environment features;

[0046] Browser fingerprint generation module 25: after extracting the features, a hash algorithm is used to generate a browser fingerprint to identify and track the attacker;

[0047] Data storage module 26: timely transmits all extracted features and browser fingerprints back to the server and stores them in the information database; association analysis: finds the connection between fingerprints according to the browser fingerprint association algorithm, continuously tracks the attacker, and analyzes the traceability basis through the extracted feature information;

[0048] Browser script injection techniques:

[0049] As an active defense measure, browser script injection is done by website maintenance personnel who independently add tags to the target HTML page without the risk of being removed. Although the script injection method is simple, it is a key link. Once this operation is completed, subsequent information extraction, return, and storage can be automatically executed. Once the page is opened, the rendering engine can obtain the browser script according to the link pointed to by the SRC attribute of the tag during the rendering process, and then rely on the JS interpreter to interpret and execute the JS code in the script to complete the relevant functions.

[0050] Browser script extraction techniques:

[0051] Browser script extraction technology refers to the technology of extracting some characteristic information of the browser and its device through the API provided by BOM during the execution of the browser script. According to the source, the characteristic information to be extracted can be divided into browser characteristics, operating system characteristics, device hardware characteristics, user setting characteristics and network environment characteristics.

[0052] Browser fingerprint generation technology:

[0053] The purpose of browser fingerprinting is to identify browsers, and more importantly, to identify browser users and track them. This identification must be unique and can correspond one-to-one to the feature set related to it. The method of mapping a feature set into a unique identification can be associated with the hash algorithm. The hash algorithm, also known as the hash algorithm, can transform input of any length into an output of fixed length through the hash algorithm, which is called a hash value or hash value. The hash algorithm can be understood as a compression mapping, that is, a function that can compress a message of any length into a message digest of a fixed length, which is as follows:

[0054] The hash values ​​of the same message must be the same;

[0055] Given a message, the hash value can be quickly calculated;

[0056] Even a small change to the original input message will result in a very different hash value;

[0057] It is very difficult for two different messages to have the same hash value.

[0058] In this embodiment, the data analysis unit 3 includes a correlation analysis model 31 and an abnormal behavior analysis model 32 .

[0059] The goal of the association analysis model 31 is to determine whether a new fingerprint to be tested belongs to a browser that has appeared or a browser that has not appeared. This is a multi-classification problem, and it is a multi-classification problem with an increasing number of categories and an uncertain total number of categories. In order to better solve the problem, it is transformed into a binary classification problem to determine whether the new fingerprint to be tested and the existing fingerprint belong to the same browser user. Taking into account the temporal causality of feature information in the evolution process, the matching of new and old fingerprints is regarded as a sequence prediction problem, and the long short-term memory network LSTM is used for fingerprint association.

[0060] The association algorithm combines static rules with LSTM, and mainly includes two parts: filtering candidate sets through static rules. For the fingerprint to be tested, firstly, static rule matching is performed with all fingerprints in the known fingerprint library to filter out the candidate set of the fingerprint tracking chain of the browser to which the fingerprint to be tested belongs, and the probability is obtained through the LSTM model. According to the filtered candidate set, the input features are constructed according to the browser fingerprint evolution time sequence, and the potential relationship between the fingerprint to be tested and each browser in the candidate set is inferred through the LSTM model. The probability of homology is output, and the obtained probability value is compared with the threshold to draw a conclusion on whether the fingerprint to be tested belongs to this browser fingerprint tracking chain. If it does, it is included in the fingerprint chain; otherwise, the browser to which the fingerprint to be tested belongs is regarded as a new instance and a new fingerprint chain is assigned to it.

[0061] Static rules During the screening process, the fingerprint to be tested and the known fingerprint must meet the following static rules: the operating system platform and browser type on which the browser runs must be exactly the same; the browser version remains unchanged, and if it changes, only upgrades are allowed, not downgrades; the browser's support for LocalStorage and the CANVAS value must be consistent.

[0062] In this embodiment, the core technology of the non-intrusive soft probe module 11 adopts bytecode instrumentation technology, which collects the running status of the program at a certain moment during the execution process through instrumentation.

[0063] The core technology of non-invasive soft probe is to use bytecode insertion technology to dynamically obtain information from the program. It is a technology that inserts additional code into the program for the purpose of obtaining dynamic program operation information. The inserted additional code is used to push JS files to the data accessor's terminal device on the one hand to realize device fingerprint tracking. On the other hand, the program operation information is monitored through code, mainly to obtain the five-tuple information of the data access request, SQL statement, access time and access intention.

[0064] Program instrumentation is a technology that implants probe code at specific locations in the source program and obtains the program's runtime information by running the program containing the probe code. Through instrumentation, the program's running status at a certain moment in the execution process can be collected, such as basic block coverage information, predicate coverage information, path coverage information, function call information, etc.

[0065] The multi-dimensional fingerprint acquisition module mainly collects device fingerprints and implements it by combining non-invasive soft probes with JS files implanted into user terminals. In this project, the feature parameters containing sufficient information entropy are collected, which is sufficient to distinguish the browsers of all users. For example, the user agent string User-Agent contains the name, operating system and precise version number of the browser. Different websites render text or use WebGL to render canvas elements, and the pixels generated are different. Fundamentally, each terminal device uses a different image processing engine, different export options, and different compression levels, so the graphics drawn by each computer will be slightly different. These patterns can be used to assign specific numbers (fingerprints) to user devices, which can be used to identify different users. The JS file first draws text, selects the font and size, and adds a background color. Next, the script calls the canvas API to obtain the pixel data of the canvas in dataURL format, which is basically a Base64 encoded representation of binary pixel data. Finally, the script uses the hash value of the text-encoded pixel data, which is used as the user device fingerprint to provide a basis for tracking and tracing and collaborative defense.

[0066] The business threat intelligence module mainly collects information such as malicious mobile phone numbers, email addresses, IP addresses and behaviors, and is mainly used to provide data support for the behavioral analysis module of later new data attacks.

[0067] In this embodiment, the association analysis model 31 combines static rules with LSTM, and adds SQL syntax analysis technology.

[0068] In this embodiment, the abnormal behavior analysis model 32 includes the following models: abnormal login device fingerprint anomaly, frequent login, brute force cracking, sensitive configuration item operation, remote login, abnormal access, high-frequency operation, cross-regional operation, sensitive behavior operation, sensitive keyword operation, special ultra-low frequency operation, special permission operation, and data export operation.

[0069] Abnormal login device fingerprint Abnormal login device fingerprint abnormal login includes the same device within a certain period of time, frequent registration, login, modification or reset of passwords and other device fingerprint operations, frequent login during non-working hours and other behaviors. According to the number of bytes sent in the instruction, the success and failure of the user login can be analyzed. Combined with the user log data provided by the non-invasive soft probe, a variety of abnormal login models can be extracted, such as frequent login, brute force cracking, remote login, database collision attack, etc. The common point between brute force device fingerprint cracking and database collision attack is that the same device fingerprint has a large number of login operations, and the interval between each login is very small or the device fingerprint has a fixed pattern. The difference is that brute force cracking is that the same user name has many password attempts, and most of them fail to log in, and the number of successes is relatively small. The characteristic of database collision attack is that each user name is basically tried only once, and most of them fail because the user name does not exist.

[0070] Frequent logins: The log records of users logging into the system are integrated with the fingerprints of the users' devices, and aggregated for analysis. The entropy of the access volume is calculated. The access volume satisfies the power law. Alarms are issued for access volumes that exceed the power law, the possibility of abnormalities, and the number of visits that exceed the level.

[0071] Brute force cracking: The characteristics of brute force cracking are program execution, high frequency of login access, the same user name, many incorrect passwords, and login page URL access. A time series model is established based on learning. When the access is compared with the model, an exception is found. Then, based on whether the login URL is successful or not, the number of incorrect logins due to incorrect passwords, and the nature of the device fingerprint user, it is determined whether the frequent login behavior is brute force cracking. For example, the maximum number of incorrect passwords allowed by the user and the number of bytes returned in the login URL log information are used to determine whether the login is successful or failed, and analyze the fingerprint of devices with more than a certain number of logins (10 times).

[0072] Sensitive configuration item (keyword) operations: unauthorized modification of database information, unauthorized modification of other account database permissions, etc.

[0073] Off-site login: The customer logs in from a different area than the one where they registered, or from a different area that they frequently visit. The customer's region is determined based on the customer account, and the region where the customer logs in is obtained from the IP login information. The two are compared with each other. If they are not in the same area, it is an off-site login.

[0074] Abnormal access: By collecting access records of visitors and servers in different dimensions, we conduct in-depth analysis of the protocols, correlation analysis and comparison to determine whether it is abnormal behavior or unknown threats, and provide early warning and prevention.

[0075] High-frequency operation: Compared with other users, a person repeatedly performs a specific pattern of operations in a certain period of time, such as frequently accessing and querying an information system more than 100 times within 30 minutes.

[0076] Cross-regional operations: Remote IP addresses frequently access local business systems across regions to perform operations not related to work, such as someone in Shanghai frequently accessing an application system in Beijing.

[0077] Sensitive behavior operations: abnormal number and frequency of certain normal operations, and certain operations that are irrelevant or have low relevance to actual work, such as a surge in the number of visits to a business system within a certain period of time, targeted access to certain specific information, and a large amount of fuzzy query information.

[0078] Sensitive keyword (condition) operation: In addition to work needs, query and access sensitive information, such as querying the personal information of leaders, travel arrangements, obtaining information about well-known people, information related to hot events, etc.

[0079] Special ultra-low frequency operations: Some operations only occur under specific circumstances and their frequency of occurrence is very low. For such operations, attention should be paid when they occur.

[0080] Special permission operations (privilege escalation): After the permission is elevated, it means that more modifications can be made to the database and business system, which brings more security risks and requires key monitoring.

[0081] Data export operation: batch export of data, large number of file export behaviors.

[0082] In this embodiment, the abnormal behavior analysis model 32 is trained in two ways: forward model training (forward deduction method) and reverse model training (reverse mining method).

[0083] Forward model training (forward deduction method): Forward model training refers to obtaining training samples directly through data analysis based on the feature values ​​provided by the user, extracting user information from the log, performing statistics in various dimensions, filtering with empirically preset technical and tactical models, and finally deriving a list of suspects. The results of forward model training can be manually corrected.

[0084] Reverse model training (reverse mining method): Reverse model training searches for original log records based on samples provided by users, obtains training samples after analyzing the logs from various angles, and mines out a list of people with similar behaviors based on the list of abnormal people. The results of reverse training can also be manually corrected.

[0085] In summary, first, the information acquisition unit is used to obtain the program dynamic operation information, device fingerprint collection and aggregation of malicious mobile phone numbers, email addresses, IP addresses, behaviors and other information; based on the collected data, the data extraction unit performs data preprocessing and extraction; the extracted data is analyzed and confirmed by the data analysis unit for abnormal behavior; the analyzed data is displayed in the result display unit to show the user identity and behavior.

[0086] Meanwhile, the contents not described in detail in this specification belong to the prior art known to those skilled in the art.

[0087] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0088] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A Canvas fingerprint user behavior recognition and tracking method, characterized by: The specific steps include: A1. First, the information acquisition unit (1) obtains the program dynamic operation information, device fingerprint collection and aggregation of malicious mobile phone numbers, email addresses, IP addresses, behaviors and other information; A2, performing data preprocessing and extraction in a data extraction unit (2) based on the collected data; A3. The extracted data is analyzed and confirmed by the data analysis unit (3); A4. The analyzed data is displayed in the result display unit (4) to show the user's identity and behavior.

2. According to claim 1, a Canvas fingerprint user behavior recognition and tracking method is characterized by: The output end of the information acquisition unit (1) is connected to the input end of the data extraction unit (2), the output end of the data extraction unit (2) is connected to the input end of the data analysis unit (3), the output end of the data analysis unit (3) is connected to the input end of the result display unit (4), and the information acquisition unit (1) includes a non-intrusive soft probe module (11), a multi-dimensional fingerprint acquisition module (12) and a business threat intelligence module (13).

3. According to claim 1, a Canvas fingerprint user behavior identification and tracking method is characterized by: The data extraction unit (2) comprises a data preprocessing module (21), a browser script deployment module (22), a browser script execution module (23), a feature information extraction module (24), a browser fingerprint generation module (25) and a data storage module (26).

4. According to claim 1, a Canvas fingerprint user behavior identification and tracking method is characterized by: The data analysis unit (3) includes a correlation analysis model (31) and an abnormal behavior analysis model (32).

5. According to claim 2, a Canvas fingerprint user behavior identification and tracking method is characterized by: The core technology of the non-intrusive soft probe module (11) adopts bytecode plugging technology, and collects the running state of a program at a certain moment in the execution process through plugging.

6. A Canvas fingerprint user behavior identification and tracking method according to claim 4, characterized in that: The association analysis model (31) combines static rules with LSTM and adds SQL syntax analysis technology.

7. A Canvas fingerprint user behavior recognition and tracking method according to claim 4, characterized in that: The abnormal behavior analysis model (32) includes the following models: abnormal login device fingerprint anomaly, frequent login, brute force cracking, sensitive configuration item operation, remote login, abnormal access, high-frequency operation, cross-regional operation, sensitive behavior operation, sensitive keyword operation, special ultra-low frequency operation, special permission operation, and data export operation.

8. A Canvas fingerprint user behavior identification and tracking method according to claim 4, characterized in that: The abnormal behavior analysis model (32) is trained in two ways: forward model training and reverse model training.

Images