Social engineering robot simulation method for loan investment network fraud

Abstract

The present invention proposes a social worker robot simulation method for loan investment network fraud, which belongs to the field of artificial intelligence / social engineering. Specifically: first, set up a number of social worker robots with different attributes according to actual needs, and configure user attributes for each social worker robot; fill in the micro-loan application form on each loan platform according to the attribute value, and leave the personal information of the social worker robot to the fraudster; then, build a behavior, language and voice database that conforms to the basic personality of the social worker robot, as well as a fraud process archive; then, the social worker robot interacts with the fraudster, and retains all information in the database; when the fraudster induces the social worker robot to transfer money, the social worker robot sends a transfer failure picture with a Trojan program implanted, tracks the fraudster and traces the source and feeds back to the public security department. The present invention is simple to operate and has strong practicality, which greatly improves the implementation efficiency.

Description

Technical Field

[0001] The present invention relates to a social worker robot simulation method for loan investment network fraud, belonging to the technical field of artificial intelligence / social engineering. Background Art

[0002] At present, telecommunications and Internet fraud has increasingly become one of the social "chronic diseases" of various countries. The targets of fraud have also gradually changed from wide-net fraud to precision fraud. Unlike wide-net and random fraud, precision fraud is more targeted and directional, so its deceptiveness and confusion are further enhanced, and the success rate is also higher. The leakage of personal information has become a key factor and an important driving force for the implementation of precision fraud. In addition, fraud crimes usually present the characteristics of a mixed mode of multiple criminal methods and a long time span.

[0003] Social Engineering emerged as a formal discipline around the 1960s. Kevin Mitnick pointed out in The Art of Deception that the human factor is the weakest link in the security process. In the digital world, scientific researchers have found quantum cryptography methods that can achieve absolute security in theory, and many companies have invested a lot of money in information security to purchase and install security products.

[0004] However, social engineering attackers can directly bypass all technical protection measures by deceiving internal personnel. As Yang Yixian and Niu Xinxin pointed out in "Hacker Psychology: Principles of Social Engineering", social engineering attacks generally have the following characteristics:

[0005] (1) The direct target of the attack is people, not devices.

[0006] (2) There is no direct physical contact between the attacker and the attacked.

[0007] (3) Social engineering attacks are cyber attacks, forming a closed loop chain of "feedback → fine-tuning → feedback". The attacker often needs to interact with the attacked multiple times, inducing the attacked to intentionally or unintentionally assist the hacker in approaching the final goal step by step.

[0008] (4) If you do not understand the methods of social engineering attacks, it is easy to be deceived; but if you know that others are attacking, it is easy to resolve.

[0009] By comparing the criminal process of loan investment telecommunications network fraud, it is easy to see that the criminals used social engineering attacks. Specifically: the fraudsters interacted with the victims many times according to the scripts prepared in advance, and the victims fell into the trap step by step. Therefore, social engineering research methods can be used to study the problem of telecommunications network fraud. Summary of the invention

[0010] In view of the problem in the prior art that it is impossible to effectively preserve and collect complete evidence of being deceived and to effectively track and trace the fraudsters, the present invention proposes a social engineering robot simulation method for loan investment network fraud, which achieves the effect of efficiently collecting the criminals' attack behaviors and completely preserving the evidence of being deceived, and provides a practical and effective method for tracking and tracing the fraudsters.

[0011] The social engineering robot simulation method for loan investment network fraud has the following specific steps:

[0012] Step 1: Set up several social worker robots with different attributes according to actual needs, and configure user attributes for each social worker robot.

[0013] The attributes include "information needed to be provided during the loan application process" and "information needed to be provided during the fraud process", specifically: basic information (name, gender, age, ID number and ID photo), professional information (occupation, position, education, work / study unit, location), asset information (whether there is a house, car, provident fund, social security, punch-in salary, insurance policy, business license), bank card number (opening bank, bank card number), contact information (mobile phone, WeChat, QQ, email), loan amount, etc.

[0014] Step 2: Fill out micro-loan application forms on various loan platforms based on the attribute values ​​of the social worker robot, and leave the personal information of the social worker robot to be leaked to the fraudsters.

[0015] Step 3: Build a behavior, language and voice database that conforms to the basic personality of the social engineering robot, as well as a fraud process archive;

[0016] (1) Behavior database: click links, download and install software, etc.

[0017] (2) Language database: used for online chatting with criminals;

[0018] (3) Voice database: used for voice chat with criminals;

[0019] (4) Fraud process archive: used to save and collect complete evidence of fraud.

[0020] Step 4: The social engineering robot interacts with the fraudsters and saves all the information in four databases;

[0021] Step 5. When the fraudster induces the social engineering robot to transfer money, the social engineering robot sends a picture of the failed transfer with a Trojan program implanted in it, tracks the fraudster and feeds back the tracking data to the public security department.

[0022] The advantages of the present invention are:

[0023] 1) A social engineering robot simulation method for loan investment network fraud. Since fraud crimes usually take a long time, compared with using real police officers as undercover, the present invention uses social engineering robots to greatly save police force.

[0024] 2) A social engineering robot simulation method for loan investment network fraud. As a honeypot in social engineering research, the attribute setting of the social engineering robot constructed by the present invention is more in line with the characteristics of potential victims than ordinary people and is more attractive to fraudsters, thereby greatly increasing the possibility of social engineering robots being deceived, improving the efficiency of collecting criminals' attack behaviors, and indirectly protecting other potential victims.

[0025] 3) Social engineering robot simulation method for loan investment network fraud. Social engineering robots can preserve and collect more complete evidence of fraud than ordinary victims, providing a strong basis for case detection and conviction.

[0026] 4) The social engineering robot simulation method for loan investment network fraud is that when the criminal induces the social engineering robot to transfer money, the social engineering robot uses various excuses to say that the transfer failed (such as reaching the limit, the account is frozen, and the consent of the co-owner is required, etc.), and then sends the screenshot of the transfer, and implants the Trojan program in the picture file to obtain various information from the criminal's hardware. This is difficult for real victims to accomplish.

[0027] 5) Social engineering robot simulation method for loan investment network fraud. Since most criminals (criminal gangs) in recent years have a high level of information technology, after the real victim transfers the money, the criminals will immediately transfer the stolen money by withdrawing, spending, multiple transfers, etc. to evade freezing. Therefore, from a technical point of view, tracking criminals on the Internet is more advantageous in terms of speed and security than tracking the flow of funds. It can be seen that the use of image Trojans in the present invention to achieve tracking and tracing is not only relatively simple in operation, but also has strong operability and practicality in the specific implementation process.

[0028] 6) Social engineering robot simulation method for loan investment network fraud. The social engineering robot can also analyze fraud templates through the large amount of social engineering attack chain data collected, providing real materials for anti-fraud publicity.

[0029] 7) For the social engineering robot simulation method for loan investment network fraud, considering that the behavior, language and voice required by the victim in the real fraud process are very simple, the present invention constructs a corresponding database, which is very streamlined and does not need to be frequently updated or expanded. Therefore, the implementation efficiency of the present invention can be greatly improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1A platform module built for the social worker robot simulation method of the present invention for loan investment network fraud;

[0031] Figure 2 The present invention is a flow chart of a social worker robot simulation method for loan investment network fraud. DETAILED DESCRIPTION

[0032] The present invention is further described in detail below with reference to the accompanying drawings and embodiments.

[0033] The information in this invention is collected with the consent of the user and used legally.

[0034] The present invention discloses a social worker robot simulation method for loan investment telecommunication network fraud crimes, such as Figure 1 As shown in the figure, the constructed platform modules include: (1) attribute setting module, which sets the user attributes of the social engineering robot according to the common attributes of the real victims of loan investment telecommunications network fraud crimes and the information that needs to be provided during the fraud process; (2) personal information leakage module, which discloses the user attributes of the social engineering robot according to the common information disclosure process of the real victims, that is, leaks personal information to the fraudsters; (3) interaction module with criminals, which builds a behavior library and language and voice library based on the behavior of the real victims in the real crime process (clicking on links, downloading and installing software, etc.; online chat and voice chat), and uses traditional chat robots as the basis to interact with the fraudsters in the entire fraud process and retain all information; (4) tracking and tracing module, which uses image Trojans and other means to track and trace the fraudsters; (5) data analysis and feedback module, which performs data analysis based on the obtained fraud information (social engineering attack chain).

[0035] The "attribute setting module" sets up several social robots with different attributes according to actual needs, and passes the relevant attribute data to the "personal information leakage module" and the "interaction module with criminals"; the "personal information leakage module" leaks: on which loan platform the social robot filled out the micro-loan application form, introduces the social robot "interaction module with criminals", and uses the "tracking and tracing module" to track the tracing information of the fraudsters during the interaction, and transmits the tracing data to the "data analysis and feedback module" for subsequent analysis; in recent years, most criminals (criminal gangs) have a high level of information technology and a strong anti-reconnaissance awareness, and the tracing information has a strong timeliness. Therefore, the tracing results are fed back to the public security department in a timely manner. The analysis content includes but is not limited to: fraud template analysis. The final result can provide real materials for anti-fraud propaganda and help prevent being deceived.

[0036] The social engineering robot simulation method for loan investment network fraud is as follows: Figure 2 As shown, the specific steps are as follows:

[0037] Step 1: Set up several social worker robots with different attributes according to actual needs, and configure user attributes for each social worker robot.

[0038] The user attributes of the social engineering robot include "basic attributes", "information required to be provided during loan application", and "information required to be provided during fraud" as shown in Table 1 below:

[0039] Table 1

[0040] Attribute Classification property Basic Information Name, gender, age, ID number and ID photo Career Information Occupation, position, education, work / study unit, location Asset Information Whether you have a house, car, provident fund, social security, punch-in salary, insurance policy, business license Bank card number Bank account opening bank, bank card number Contact Details Mobile phone, WeChat, QQ, email Loan amount

[0041] As a honeypot in social engineering research, the social engineering robot constructed by the present invention has attributes that are more in line with the characteristics of potential victims than ordinary people and more attractive to fraudsters. By finding representative elements of several types of victims in the victim database, the attributes of the social engineering robot that are more attractive to fraudsters are as follows:

[0042] The first is an algorithm based on cluster analysis:

[0043] (1) Based on the existing victim data, the research selected attributes and initial representative elements based on experience.

[0044] Experience mainly comes from the police's experience in solving crimes and the confessions of the fraudsters who have been caught. Of course, based on the existing unsupervised learning algorithms such as cluster analysis, it is possible to directly obtain the representative elements of several types of victims (i.e., the mean vector of each cluster) without relying on experience. However, considering that online fraud usually follows a certain fraud routine, the efficiency of the algorithm can be greatly improved based on experience (the fraud routine that has been understood).

[0045] (2) According to the cluster analysis algorithm, the existing sample (victim) data is cleaned, normalized, and the distance is calculated, etc., and several clusters (i.e., several types of victims) and the mean vector of each cluster (i.e., the representative element of several types of victims) are obtained through repeated iterations.

[0046] (3) The representatives of each of the above clusters are several types of representative and attractive victims.

[0047] The second algorithm is based on random sampling:

[0048] By collecting existing victim data, mainly from the police's experience in solving cases and the confessions of the fraudsters who have been caught, the above data are arranged and numbered from 1 to N. According to the number of social engineering robots m to be generated, samples are taken from the above data, and the victim attributes obtained by sampling are used as the attributes of the social engineering robot.

[0049] This operation is simple and easy, and is sufficient to obtain an attractive social engineering robot. This is because: Internet fraud is usually carried out according to certain fraud routines, and fraudsters also have certain standards for selecting victims. This means that there are a lot of individuals among the existing victims who are close to the above standards and belong to different types of victims. Through random sampling, if individuals with certain attributes are more attractive, then there will be more individuals with such attributes in the victim database, and the probability of randomly sampling individuals with this attribute is greater.

[0050] Step 2: Fill out micro-loan application forms on various loan platforms based on the attribute values ​​of the social worker robot, and leave the personal information of the social worker robot to be leaked to the fraudsters.

[0051] Step 3: Build three databases (behavior, language, and voice databases) that conform to the basic personality of the social engineering robot and a fraud process archive library;

[0052] In fact, considering that online fraud usually follows certain fraud routines, the common behaviors and languages ​​of fraudsters and victims are far less than those of traditional chatbots. Directly building a more concise behavior, language and voice database can greatly simplify operations and reduce dependence on the existing achievements of others.

[0053] (1) Behavior database: click links, download and install software, etc.

[0054] (2) Language database: used for online chatting with criminals;

[0055] (3) Voice database: used for voice chat with criminals;

[0056] (4) Fraud process archive: used to preserve and collect complete evidence of fraud, providing a strong basis for case detection and conviction.

[0057] The fourth database (fraud process archive) is the same for all social engineering robots. However, the first three databases (behavior, language, and voice databases) need to be constructed for social engineering robots with different attributes, so that the behavior and language habits of social engineering robots are consistent with human settings, avoiding fraudsters from discovering their undercover identities.

[0058] The corpus for building the database comes from 2 internal channels and 4 external channels:

[0059] Internal channels: (1) Crime report information received by the police; (2) Fraud schemes confessed by arrested fraudsters.

[0060] External channels: (1) "Research Report on the Governance of Telecom Network Fraud under the New Situation (2020)" compiled by the Security Research Institute of the China Academy of Information and Communications Technology; (2) "Internet Crime Reporting Website" sponsored by the Ministry of Public Security of the People's Republic of China; (3) "Comprehensive Anti-Fraud App" sponsored by the Ministry of Public Security's New Types of Telecom Network Crime Investigation and Control Center and Beijing Municipal Public Security Bureau; (4) "Special Report on Cybercrime Judicial Big Data" and 10 typical cases of telecom network fraud crimes released by the China Judicial Big Data Research Institute of the Supreme People's Court in November 2019.

[0061] The key to this step is to build targeted and different databases for different types of victims, so that the behavior and language habits of the social engineering robot are consistent with the human setting, avoiding the undercover identity being discovered by the fraudsters.

[0062] Specifically, for the different attributes of the social working robot selected in step one, based on the six corpus sources for constructing the database mentioned above, we first select the victim information and fraud experiences that are basically consistent with the attributes of the social working robot, organize the communication process (behavior, language, voice) between these victims and the fraudsters, and construct a behavior, language, and voice database that is consistent with the attributes of the social working robot.

[0063] Step 4: The social engineering robot interacts with the fraudsters and saves all the information in four databases;

[0064] Step 5. When the fraudster induces the social engineering robot to transfer money, the social engineering robot sends a picture of the failed transfer with a Trojan program implanted in it, tracks the fraudster and feeds back the tracking data to the public security department.

[0065] When fraudsters induce social engineering robots to transfer money, they use various excuses to say that the transfer failed (such as reaching the limit, the account is frozen, the consent of the co-owner is required, etc.), and then send the screenshots of the transfer, and implant the Trojan program in the picture file to obtain various information from the criminals' hardware. In this way, the criminals can be tracked and traced using the picture Trojan. The public security department conducts data analysis based on the obtained fraud information (social engineering attack chain).

[0066] Example

[0067] There are four sources of data: (1) "Research Report on the Governance of Telecom Network Fraud under the New Situation (2020)" compiled by the Security Research Institute of the China Academy of Information and Communications Technology; (2) "Internet Crime Reporting Website" sponsored by the Ministry of Public Security of the People's Republic of China; (3) "Comprehensive Anti-Fraud App" sponsored by the Ministry of Public Security's New Types of Telecom Network Crime Investigation and Control Center and Beijing Municipal Public Security Bureau; (4) "Special Report on Cybercrime Judicial Big Data" and 10 typical cases of telecom network fraud crimes released by the China Judicial Big Data Research Institute of the Supreme People's Court in November 2019.

[0068] In the first step, the attribute setting module sets the user attributes of the social worker robot;

[0069] First, based on real data analysis, we can get the common basic attributes of victims of this type of fraud, including: under 40 years old, strong consumer demand; few or no tangible assets, unable to meet the requirements of mortgage loans; and having used small loans such as campus loans. The basic attribute settings of social robots will be close to the common attributes of real victims in order to confuse and attract social engineering attackers.

[0070] Then, the information you need to provide during the loan application process.

[0071] As mentioned above, nowadays, fraudsters gradually change from casting a wide net to precision fraud in the selection of fraud targets. The leakage of personal information has become a key factor and an important driving force for the implementation of precision fraud. According to the analysis of real data, real victims usually apply for small loans on various loan platforms, use search engines to find online loan channels, click on loan pop-up ads on websites, etc., and leave personal information such as mobile phone numbers when filling in the form. This information will become the basis for fraudsters to choose their targets. The social worker robot involved in this embodiment, as a honeypot in social engineering research, must have its attribute settings that are more in line with the characteristics of potential victims than the general population, and more attractive to fraudsters, so that it is easier to be selected as a potential victim (crime target) by fraudsters.

[0072] Information required during the scam:

[0073] According to the real fraud implementation script (predetermined crime implementation process), during the fraud process, the deceived person will provide information such as mobile phone, WeChat, QQ, bank card number, etc. under the guidance of the criminal. It is necessary to pre-set matching attribute values ​​to avoid arousing the suspicion of the criminal.

[0074] It can be seen that the attribute setting module will set the attributes of the social engineering robot based on the real victims and the criminal process, and ensure that: (1) the information is consistent and not likely to arouse suspicion from criminals; (2) it is more in line with the characteristics of potential victims than the general population and more attractive to fraudsters. This module sets the attributes of the social engineering robot, which can be divided into two steps:

[0075] Step 1: Set basic property information.

[0076] Table 1

[0077] Attribute Classification property Basic Information Name, gender, age Career Information Occupation, position, education

[0078] Step 2: Based on the basic attributes, complete the detailed attributes.

[0079] Table 2

[0080] Attribute Classification property Basic Information Name, gender, age, ID number and ID photo Career Information Occupation, position, education, work / study unit, location Asset Information Whether you have a house, car, provident fund, social security, punch-in salary, insurance policy, business license Bank card number Bank account opening bank, bank card number Contact Details Mobile phone, WeChat, QQ, email Loan amount

[0081] In the basic information:

[0082] (1.1) The ID number and ID photo information must be consistent with the name, gender and age;

[0083] (1.2) According to the actual victim data, the age range is 20-40 years old.

[0084] In the career information:

[0085] (2.1) Occupation, position, and education level need to match age;

[0086] (2.2) Occupation, work / study unit, and location match each other;

[0087] (2.3) The attribute values ​​of occupational attributes include: student, unemployed, self-employed, etc.;

[0088] (2.4) The attribute value of the position attribute should be the lower position that matches the occupation.

[0089] In the asset information:

[0090] (3.1) According to the data of real victims, there are few or no tangible assets, which cannot meet the requirements of mortgage loans. Therefore, the attribute values ​​of whether there is a house, car, or insurance policy are all "none";

[0091] (3.2) The attribute values ​​of whether there is provident fund, social security, punch-in salary, and business license need to match the occupation.

[0092] In bank card number:

[0093] (4.1) The bank card number and the bank account opening bank match each other;

[0094] (4.2) The location of the bank account opening and the place of work / study should match each other;

[0095] In contact details:

[0096] (5.1) The mobile phone, WeChat, QQ, and email address match each other, are bound to each other, and have similar profile pictures and nicknames;

[0097] (5.2) Mobile phones, WeChat, QQ and email can be used for communication as normal.

[0098] Of the borrowed amount:

[0099] (6.1) The loan amount should be matched with age and occupation. For example, the loan amount for a student in his / her 20s should range from RMB 10,000 to RMB 50,000; the loan amount for a self-employed business owner in his / her 30s should range from RMB 100,000 to RMB 500,000.

[0100] The second step is to use the personal information leakage module to leak the personal information of the social engineering robot to the fraudsters.

[0101] As mentioned above: Personal information leakage has become a key factor and an important driving force for the implementation of precision fraud. According to real data analysis, real victims usually apply for small loans on various loan platforms, use search engines to find online loan channels, click on loan pop-up ads on websites, etc., and leave personal information such as mobile phone numbers when filling out the application. This information will become the basis for fraudsters to choose targets.

[0102] This module aims to fill in small loan application forms on various loan platforms based on the attribute values ​​of the social engineering robot, thereby leaving personal information such as mobile phone numbers. This will naturally leak the personal information of the social engineering robot to the fraudsters.

[0103] Step 3: Use the criminal interaction module to realize the interaction between the social worker robot and the fraudsters;

[0104] According to the behaviors of real victims in real crimes, we build behavior libraries and language and voice libraries. This module combines existing crawler technology and chatbot technology. During the setting process, the language and behavior need to conform to the basic personality of the social engineering robot and not easily arouse the suspicion of criminals. In addition, this module will retain all the information about the interaction with criminals during the entire fraud process.

[0105] Step 4: Use the tracking and tracing module to track down the fraudsters;

[0106] As mentioned above, most criminals (criminal gangs) in recent years have a high level of information technology. After the real victim transfers the money, the criminals will immediately transfer the stolen money by withdrawing, spending, transferring multiple times, etc. to evade freezing. Therefore, it is more advantageous to track criminals on the Internet from a technical point of view than to track the flow of funds in terms of speed and security. This module adopts the idea of ​​"returning the favor in the same way". When criminals induce social robots to transfer money, social robots use various excuses to say that the transfer failed (such as reaching the limit, the account is frozen, the consent of the co-owner is required, etc.), and then send the screenshot of the transfer, and implant the Trojan program in the picture file to obtain various information in the criminal's hardware. Therefore, using the picture Trojan, this module can track and trace the criminals. At the same time, the traceability results are fed back to the public security department.

[0107] Step 5: Use the data analysis and feedback module to analyze the traceability information.

[0108] Data analysis is performed based on a large amount of fraud information (social engineering attack chain data) and the obtained tracking and tracing information. These analysis contents include but are not limited to: fraud template analysis. The results of this module can provide real materials for anti-fraud publicity and help prevent being deceived.

[0109] ●Example 1

[0110] Module 1: Property setting module

[0111] Basic attributes: A fourth-year undergraduate student at an ordinary university, female, 22 years old, with an estimated loan amount of 20,000 yuan for consumption. The detailed attributes must be consistent with the basic attributes, especially in the "asset information section", the attribute values ​​of whether there is a house, car, provident fund, social security, punch-in salary, insurance policy, business license, etc. are all "none".

[0112] Module 2: Personal Information Leakage Module

[0113] As mentioned earlier, when applying for micro loans on various loan platforms, using search engines to find online loan channels, clicking on pop-up loan ads on websites, etc., personal information such as mobile phone numbers were left when filling out the form.

[0114] Module 3: Interaction with criminals

[0115] Based on the behaviors of real victims in real crimes, we build behavioral databases, language databases, and voice databases by integrating existing crawler technology and chatbot technology. The above databases need to conform to the habits of fourth-year female students in ordinary undergraduate colleges and universities, and are not likely to arouse suspicion from criminals. In addition, the fraud process archive retains all information about the interaction with criminals during the entire fraud process, providing a strong basis for case detection and conviction.

[0116] Module 4: Tracking and tracing module

[0117] When criminals induce social engineering robots to transfer money, they use various excuses to say that the transfer failed (such as reaching the limit, the account is frozen, the consent of the co-owner is required, etc.), and then send the screenshots of the transfer, and implant the Trojan program in the picture file to obtain various information from the criminals' hardware. Therefore, using the picture Trojan, this module can track and trace the criminals. At the same time, the traceability results are fed back to the public security department.

[0118] Module 5: Data Analysis and Feedback Module

[0119] Data analysis is performed based on the large amount of fraud information (social engineering attack chain data) obtained from module 3 and the tracking and tracing information obtained from module 4.

[0120] ●Example 2

[0121] Module 1: Property setting module

[0122] Basic attributes: Individual business owner (entrepreneur), male, 35 years old, college degree, estimated loan amount of 300,000 yuan, used for capital turnover and investment in new projects. The detailed attributes should be consistent with the basic attributes, especially in the "asset information part", the attribute values ​​of whether there is a house, provident fund, social security, punch-in salary, insurance policy, etc. are all "no"; whether there is a car, business license, etc. are all "yes".

[0123] Module 2: Personal Information Leakage Module

[0124] As mentioned earlier, when applying for micro loans on various loan platforms, using search engines to find online loan channels, clicking on pop-up loan ads on websites, etc., personal information such as mobile phone numbers were left when filling out the form.

[0125] Module 3: Interaction with criminals

[0126] Based on the behaviors of real victims in real crimes, we build behavioral databases, language databases, and voice databases by integrating existing crawler technology and chatbot technology. The above databases need to conform to the habits of ordinary individual business owners who are in urgent need of capital turnover, and are not likely to arouse suspicion from criminals. In addition, the fraud process archive retains all information about the interaction with criminals during the entire fraud process, providing a strong basis for case detection and conviction.

[0127] Module 4: Tracking and tracing module

[0128] When criminals induce social engineering robots to transfer money, they use various excuses to say that the transfer failed (such as reaching the limit, the account is frozen, the consent of the co-owner is required, etc.), and then send the screenshots of the transfer, and implant the Trojan program in the picture file to obtain various information from the criminals' hardware. Therefore, using the picture Trojan, this module can track and trace the criminals. At the same time, the traceability results are fed back to the public security department.

[0129] Module 5: Data Analysis and Feedback Module

[0130] Data analysis is performed based on the large amount of fraud information (social engineering attack chain data) obtained from module 3 and the tracking and tracing information obtained from module 4.

Claims

1. A social engineering robot simulation method for loan investment network fraud, characterized in that: The specific steps are as follows: First, set up several social worker robots with different attributes according to actual needs, and configure user attributes for each social worker robot; fill in small loan application forms on various loan platforms according to the attribute values ​​of the social worker robots, and leave the personal information of the social worker robots to be leaked to the fraudsters; The user attribute setting is performed by finding representative elements of several types of victims in the victim database, as follows: The first is an algorithm based on cluster analysis: (1) Based on the existing victim data, the attributes and initial representative elements are selected based on experience; The experience mainly comes from the police's experience in solving cases and the confessions of the fraudsters who have been caught; (2) According to the cluster analysis algorithm, the existing victim data is cleaned, normalized, and the distance is calculated. Several clusters are obtained through repeated iterations, representing several types of victims. The mean vector of each cluster is calculated as the representative element of several types of victims. (3) The representatives of each of the above clusters are several types of representative and attractive victims; The second algorithm is based on random sampling: By collecting the existing victim data, arranging and numbering them from 1 to N, sampling from the above data according to the number of social engineering robots m that need to be generated, and using the victim attributes obtained by sampling as the attributes of the social engineering robot; Then, we build a behavior, language and voice database that matches the basic personality of the social engineering robot, as well as an archive of the fraud process; Next, the social engineering robot interacts with the fraudsters and stores all the information in four databases. When the fraudsters induce the social engineering robot to transfer money, the social engineering robot sends a picture of the failed transfer with a Trojan program implanted in it, tracks the fraudsters and feeds the tracking data back to the public security department. The four databases include: (1) Behavior database: click links, download and install software; (2) Language database: used for online chatting with criminals; (3) Voice database: used for voice chat with criminals; (4) Fraud process archive: used to save and collect complete evidence of fraud.

2. A social engineering robot simulation method for loan investment network fraud as described in claim 1, characterized in that: The user attributes include "information required to be provided during loan application" and "information required to be provided during fraud", specifically including: Basic information: name, gender, age, ID number and ID photo; Professional information: occupation, position, education, work / study unit and location; Asset information: whether you own a house, car, provident fund, social security, punch-in salary, insurance policy, business license, bank card number, contact information and loan amount.

3. A social worker robot simulation method for loan investment network fraud as described in claim 1, characterized in that: Specifically, the database construction described above is to first select the victim information and fraud experience that are basically consistent with the attributes of the social engineering robot and the fraudsters according to the corpus source for database construction, and sort out the communication process between these victims and the fraudsters, namely, behavior, language and voice; and respectively construct behavior, language and voice databases that are consistent with the attributes of the social engineering robot; The behavior database is used to click on links, download and install software; the language database is used to chat with criminals online; the voice database is used to have voice chats with criminals; and the fraud process archive is used to save and collect complete evidence of fraud.

Images