Method and apparatus for automated perception generation and deployment of browser decoy accounts
By automatically generating and deploying browser decoy accounts, the problem of low realism and high resource consumption in existing technologies is solved, achieving high realism protection and information security for user terminals.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- GUANGZHOU UNIVERSITY
- Filing Date
- 2023-07-24
- Publication Date
- 2026-08-04
AI Technical Summary
Existing honeypot technology lacks protection for individual client machines, the decoy account generation process lacks awareness of the actual environment, the generated accounts are not very realistic and are difficult to deceive attackers, and EDR technology consumes a lot of system resources, affecting user privacy and business efficiency.
By automatically generating decoy browser accounts, the semantics and string patterns of user browser login credentials are analyzed to generate decoy accounts that are similar to user credentials. These decoy accounts are then encrypted and inserted into the browser database, stored together with real accounts. The server synchronously monitors the usage of these decoy accounts.
It improves the realism of browser accounts, confuses attackers, reduces user information leakage, lowers EDR system resource consumption, and achieves effective protection of user terminals.
Smart Images
Figure CN116800528B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of decoy accounts, and in particular to a method and apparatus for automatically generating and deploying browser decoy accounts. Background Technology
[0002] Cybersecurity incidents often lead to the leakage of user privacy information or direct financial losses, posing a significant threat to users. In response to the increasing trend of cyberattacks, cyber defense methods are constantly evolving, with high adversarial nature becoming the essence of cybersecurity attack and defense. Honeypot technology transforms the traditional passive defense approach into a decoy-based active defense, greatly enhancing the defender's initiative in attack and defense confrontations, and has gained widespread attention.
[0003] Honeypots, also known as honeypot technology, are a proactive defense technique that uses systems devoid of real business data to lure attackers into launching attacks. By recording these attacks, the system learns the attacker's objectives and methods, disrupting their attack rhythm, increasing attack complexity, and adding more response time to the system. Furthermore, it may be possible to analyze and trace the attacker's actions to prevent future attacks.
[0004] In 1999, renowned information security expert Lance Spitzner proposed the concept of a honeytoken, building upon the honeypot concept, to describe a special type of honeypot decoy. It is not any host node, but rather a tagged digital entity. It is defined as any storage resource not used for regular production purposes, such as text files, email messages, or database records. A honeytoken must be unique and easily distinguishable from other resources to avoid false alarms.
[0005] Currently, honeypot account technology is mostly used on servers for centralized authentication in system logins and web applications. It primarily protects the security of authentication servers and account databases, and provides timely detection of data breaches. However, there is currently a lack of honeypot technologies specifically designed to protect the large number of individual client machines.
[0006] A web browser is an application used to retrieve and display information resources on the World Wide Web. These resources can be web pages, images, videos, or other content, and are identified by a Uniform Resource Identifier (URI). Hyperlinks within these resources allow users to easily browse related information. Browsers are essential windows and tools for users to access online information, and are an inseparable part of computers and the internet; almost every personal computer currently has at least one browser installed. When users engage in online activities using a browser, the browser saves their browsing history, bookmarks, cookies, and frequently used account credentials for user convenience. Therefore, browsers store a large amount of information about users' online behavior, lifestyle, and personal data, making them a significant target for attackers to collect user privacy and confidential information.
[0007] Existing honey tag technology mainly includes three types: bait strings, bait files, and bait accounts.
[0008] Decoy strings include deceptive information in the form of fake file content, fake historical commands, and fake system configuration information generated and deployed on the target host. These strings are attractive and enticing to attackers, confusing their attack decisions, disrupting their attack rhythm, and giving the system more time for emergency response.
[0009] Decoy files include beacon documents, exploit documents, and self-generated simulated documents. Beacon and exploit documents are primarily used for tracing and countermeasures after attackers steal the document. Both types of documents contain special code that executes when opened, either transmitting the location information of the host that opened the document or directly exploiting relevant vulnerabilities to control the host and trace the attacker. Simulated documents utilize natural language processing technology to generate similar but different documents based on the real document through generation, replacement, and recombination, thus misleading attackers and making it difficult for them to find the real document.
[0010] Decoy accounts, also known as honeypot accounts, are created by inserting fake accounts into the system that are not used by normal users. The server monitors the logins and other operations of these fake accounts. When a decoy account is used, the system generates an alert or redirects the decoy account login to the honeypot machine.
[0011] The drawbacks of decoy strings are that the attacker's attack path and attack intent are unknown, and it is impossible to accurately predict the information that the attacker will focus on during or after the intrusion. If the attacker's attack path avoids the location where the decoy string is deployed, the deception effect of the decoy string will be reduced.
[0012] The drawback of decoy files is that experienced attackers use sandbox environments to process the files or programs they obtain. In a sandbox environment, decoy files cannot interact with the real host, making it difficult to achieve countermeasures and source tracing.
[0013] Decoy accounts are currently primarily used on the server side, and less frequently on the client side. The generation process of decoy accounts lacks awareness of the actual environment, and the generated accounts do not closely resemble real accounts, making it difficult to deceive attackers into using them.
[0014] EDR technology monitors and records the behavior of the entire terminal system, enabling timely detection, reporting, and handling of anomalies. Its main drawback is its high system resource consumption. EDR software needs to monitor and record the behavior of the entire computer, a function that consumes significant system resources and impacts the efficiency of normal business operations. Secondly, it poses a risk of privacy breaches for users, as all user actions on the computer are recorded by the EDR software, making it difficult to guarantee that users' personal privacy will not be compromised. Summary of the Invention
[0015] The purpose of this invention is to provide a method and apparatus for automatically generating and deploying browser decoy accounts, aiming to solve the problem of generating and deploying decoy accounts.
[0016] This invention provides a method for automatically generating and deploying browser bait accounts, comprising: S1. Obtain the login credentials that already exist in the user's browser, analyze the semantics and string patterns of the user's login credentials, and generate a decoy account with semantics and string patterns similar to the login credentials in the user's browser. S2. After encrypting the bait account using the encryption API, insert it into the browser's database and store the encrypted bait account together with the user's real account password data. S3. The server synchronizes bait information and monitors the usage of bait accounts.
[0017] This invention also provides an automated detection, generation, and deployment device for browser decoy accounts, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the above method.
[0018] This invention also provides a computer-readable storage medium storing an information transmission implementation program, which, when executed by a processor, implements the steps of the above-described method.
[0019] Using the embodiments of the present invention, decoy accounts can be generated and deployed.
[0020] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description
[0021] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0022] Figure 1 This is a flowchart of a method for automatically generating and deploying browser bait accounts according to an embodiment of the present invention; Figure 2 This is a schematic diagram illustrating the method for automatically generating and deploying browser bait accounts according to an embodiment of the present invention; Figure 3 This is a schematic diagram illustrating the deployment of the automated perception generation and deployment method for browser bait accounts according to an embodiment of the present invention; Figure 4 This is a schematic diagram illustrating the method for automatically generating and deploying browser bait accounts according to an embodiment of the present invention. Figure 5 This is a schematic diagram of an apparatus for automatically generating and deploying browser bait accounts according to an embodiment of the present invention. Detailed Implementation
[0023] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0024] Method Implementation Examples According to embodiments of the present invention, a method for automatically generating and deploying browser bait accounts is provided. Figure 1 This is a flowchart of a method for automatically generating and deploying browser bait accounts according to an embodiment of the present invention, such as... Figure 1 As shown, it specifically includes: S1. Obtain the login credentials that already exist in the user's browser, analyze the semantics and string patterns of the user's login credentials, and generate a decoy account with semantics and string patterns similar to the login credentials in the user's browser. S2. After encrypting the bait account using the encryption API, insert it into the browser's database and store the encrypted bait account together with the user's real account password data. S3. The server synchronizes bait information and monitors the usage of bait accounts.
[0025] Generating a decoy account with semantics and string patterns similar to the login credentials in the user's browser specifically includes: extracting semantic information contained in the account name through a semantic analysis module, abstracting and classifying the extracted semantic information, finding potential replacement words for different categories of semantic information, analyzing the string pattern of the account name through a string extraction module, and filling different replacement words into the position to be replaced according to the specified format by the semantic analysis module to become the final decoy account name.
[0026] The semantic analysis module extracts semantic information from usernames, abstracts and categorizes this information, and identifies potential replacement words based on the different categories. The string extraction module analyzes the string patterns of usernames, specifically including the semantic information that users wish to assign to their usernames when creating them. ; in Representing different semantics, semantic information is extracted into summary information with a smaller data volume:
[0027] Where d j Representing different summary information, by one or more The derivation yields that:
[0028] Users based on the summary Further abstract the words representing individual characteristics :
[0029] End user account name Depend on It is composed of the elements arranged and combined in the following way:
[0030] Receive user account name As a parameter, for Pattern extraction, word segmentation, and word meaning extraction are performed to obtain the personalized feature representation words inferred by the model analysis. :
[0031] Depend on inverse operation from Generate a set of sentence summaries with relevant specific semantics. :
[0032] Depend on inverse operation ,enter The model infers the semantics contained in the account name. :
[0033] Then generate model pairs The semantics of the text are analyzed, and text with similar synonyms or semantic meanings is selected for replacement to generate a new text. : , ; get After the data is collected, the process of simulating user account creation is used. Semantic abstraction is used to generate candidate strings.
[0034] The string extraction module analyzes the string patterns of usernames, specifically including: username length characteristics, special character characteristics, numeric characteristics, keyboard input pattern characteristics, character combination pattern characteristics, and user uniqueness characteristics. The semantic analysis module selects different replacement words based on the string pattern and fills them into the position to be replaced in a specified form to become the final decoy account name. Specifically, it includes: extracting the string features of the username, modifying the candidate string according to the features, performing appropriate random mutations, and then concatenating the candidate strings to form the final decoy account name.
[0035] The semantic analysis module selects different replacement words based on the string pattern and fills them into the position to be replaced in a specified form to become the final decoy account name. Further, it includes: using white-box testing and black-box testing to test and evaluate the realism of the decoy account name.
[0036] S2 specifically includes: encrypting the decoy account using an encryption API and inserting it into the browser's database; storing the encrypted decoy account together with the user's real account password data; and making the decoy account more realistic by directly inserting it into the database and setting the creation time, last usage time, and number of modifications of the decoy account.
[0037] S3 specifically includes: reusing the API that the client sends login requests to the server to synchronize information of the decoy account, and detecting the usage of the decoy account on the server side.
[0038] The technical problem to be solved by this invention: This invention mainly addresses the following technical problems: (1) it proposes a method for automatically generating decoy accounts based on the perceived context environment; (2) it proposes a browser-based decoy account deployment method to protect users' personal information on their personal computers and monitor the leakage of user data; (3) it proposes a method for synchronizing decoy account information between the user end and the server and detecting the use of decoy accounts. (1) A method for automatically generating decoy accounts based on perceived context. This paper proposes an automated method for generating decoy accounts based on a context-aware environment. This method can detect existing login credentials in a user's browser, analyze the semantics and string patterns of these credentials, and generate decoy accounts with semantics and string patterns similar to those in the user's browser. Research shows that usernames in online applications are rich in semantic information, typically reflecting the owner's identity or personality traits, such as name, place of origin, date of birth, and preferences. Different users also have different username naming characteristics, such as length, use of special symbols or numbers, and character patterns. The context-aware decoy account generation method inputs the user's original account into a decoy account generation model, which consists of two parts: a semantic extraction module and a string pattern extraction module. The semantic extraction module extracts the semantic information contained in the username, abstracts and classifies the extracted semantic information, and then finds potential replacement words for different categories. The string pattern extraction module analyzes the string patterns of the username, such as alphanumeric segments, alternating alphanumeric pairs, and combinations of symbols and letters. For example, wangwu0605 can be simplified to L6D4, where L represents a letter and D represents a number. Finally, based on the pattern, different replacement words are selected and filled into the positions to be replaced in a specified format to become the final bait account name. Figure 2 This is a schematic diagram illustrating the method for automatically generating and deploying browser bait accounts according to an embodiment of the present invention; The semantic analysis module analyzes the semantic information of user accounts. Assume that when a user creates an account name, they want to assign the following semantic information: , in Representing different semantic meanings. Due to the large amount of initial semantic information data, it did not meet the account name setting rules. The user then extracted the semantic information into a smaller summary:
[0039] Where d j Representing different summary information, by one or more The derivation yields that:
[0040] Users based on the summary Further abstract the words representing individual characteristics :
[0041] End user account name Depend on It is composed of the elements arranged and combined in the following way:
[0042] The decoy account generation model receives user account names. As a parameter, for Pattern extraction, word segmentation, and word meaning extraction are performed to obtain the personalized feature representation words inferred by the model analysis.
[0043]
[0044] Depend on inverse operation from Generate a set of sentence summaries with relevant specific semantics. ,
[0045] Depend on inverse operation ,enter The model infers the semantics contained in the account name.
[0046]
[0047] Then generate model pairs The semantics of the text are analyzed, and text with similar synonyms or semantic meanings is selected for replacement to generate a new text.
[0048] ,
[0049] get After the data is processed, the account generation module mimics the user's account creation process. Semantic abstraction is performed to generate candidate strings for subsequent generation.
[0050] The pattern extraction module extracts the string pattern of the username, mainly including the following features: 1) Username length characteristics 2) Special character features 3) Numerical characteristics 4) Keyboard input mode characteristics 5) Character combination pattern features 6) User unique characteristics After extracting the string features of the username, the candidate strings are modified according to the features, and appropriate random mutations are performed. Then, the candidate strings are concatenated to form the honeypot account name.
[0051] The realism of honeypot accounts generated under the generative model is unknown. Therefore, it is necessary to introduce a test and evaluation method for the realism of generated honeypot accounts. Based on whether the true semantics of the user account are known, it is divided into white-box testing and black-box testing.
[0052] In white-box testing, given the true semantic meaning of user-created usernames, during the model's semantic derivation phase, semantic similarity calculation methods are used to analyze whether the model's deviation from the semantic information of the usernames exceeds a set threshold. Usernames are short texts, generally under 30 characters, typically composed of adjectives and nouns. Nouns describe the object being described, while adjectives describe or supplement the nouns. The noun part expresses the basic semantic meaning of the username, while adjectives reflect the noun's positive or negative connotations and emotional characteristics. Generally, when using a model to extract the semantics of usernames, nouns need to be given higher weights for better semantic extraction. Deep learning methods can obtain semantic vectors of username creation semantics; by calculating the distance between two vectors, this distance can be used as the text similarity.
[0053] Currently, there are two main methods for word vector generation: Word2vec and GloVe. Both techniques essentially vectorize words based on the frequency of similar word distributions in a corpus. Word2vec uses a method of mutual prediction between words for calculation, while GloVe uses a co-occurrence matrix. This invention uses Word2vec to encode the semantic parts of account names. The Word2vec model is trained using a large amount of text; after training, the input is the prediction word, and the output is the predicted word.
[0054] After obtaining word vectors, common distance calculation methods include Euclidean distance, Manhatan distance, cosine similarity distance, Hamming distance, and Pearson correlation coefficient. Here, we use the Pearson correlation coefficient to calculate similarity:
[0055] in The text vectors represent the original user username semantic text and the model-derived username semantic text, respectively. Indicates distance, Representing text and text The distance between them This represents the covariance of the text vector. and The standard deviation is denoted by . The Pearson correlation coefficient measures a value greater than -1 and less than 1, while the distance between two variables that are almost unrelated is 0.
[0056] In black-box testing, since the true semantic meaning of user-created usernames is unknown, a heuristic method is used to determine the fidelity of the usernames based on the final generated usernames. Assume there is one real user account and the number of generated honeypot accounts is... If there are 1, then the probability that the attacker guesses the real account should be 1 / 2. .
[0057] (2) A browser-based decoy account deployment method Figure 3 This is a schematic diagram illustrating the deployment of the automated perception generation and deployment method for browser bait accounts according to an embodiment of the present invention; This section focuses on protecting user accounts and deceiving attackers. Based on the way user credentials are stored in browsers, a method is designed to insert bait accounts into the browser according to the user's current browser state. In the original state, the user's browser only stores login credentials for frequently used websites. The browser encrypts the user's credentials and stores them in a local database or configuration file. The API and key information used for encryption are stored locally on the user's machine.
[0058] If an attacker compromises a user's computer, they can extract the user's encrypted login credentials by implanting malware or Trojans. They can then decrypt these credentials using the user's computer's local API to obtain the plaintext login credentials. This plaintext can then be used to impersonate the user's account and steal user information and assets.
[0059] Figure 4 This is a schematic diagram illustrating the method for automatically generating and deploying browser bait accounts according to an embodiment of the present invention. To address the vulnerability of storing user information in browsers, by utilizing the browser's local encryption API and combining it with the technology in (1), a carefully designed decoy account can be encrypted using the encryption API and inserted into the browser's database, stored alongside the user's real account password data. When an attacker uses malware or Trojan programs to extract user credentials, they will extract the decoy account along with the real account. Since the same encryption API and key are used, both the decoy account and the user account can be decrypted normally. When the attacker decrypts the credentials, they will obtain a set of seemingly authentic decoy account credentials and a real account credential. Generating a decoy account requires obtaining the user's real account information. The user can choose to authorize the program to read the account information stored in the browser or enter their own account and password. By directly inserting the decoy account into the database, attributes such as the creation time, last use time, and number of modifications of the decoy account can be set to make the decoy account more realistic. After the attacker obtains the decoy account and real account information, it is difficult to locate the real account from this batch of accounts. They need to adopt strategies or algorithms to try and guess the real account. In this process, the attacker's energy is consumed, and the user has more reaction time.
[0060] (3) A method for synchronizing the client and server and detecting decoy accounts Deploying a decoy account alone can only confuse attackers. To fully utilize the honeypot's functionality, it's necessary to detect whether the decoy account is being used by attackers. Detecting the use of decoy accounts locally on the user's machine is difficult; attackers typically choose to steal credentials, analyze them, and then exploit them, rather than directly using the credentials on the user's host. Therefore, the user's client needs to cooperate with the server to detect the use of decoy accounts.
[0061] The server is the target of account credentials usage and receives login requests from all user accounts, so it is most appropriate to place the decoy account usage detection on the server side. The server-side detection of decoy account usage first needs to know the decoy account information, that is, to synchronize the user's local decoy account information to the server. Here, a method is proposed to reuse the API of the client to initiate login requests to the server to synchronize the decoy account information. The specific method and steps are as follows: (1) The user initiates a login request to the server, fills the login form with the username and password positions interchanged and sends the data. (2) The server receives the user login request, recognizes that the request is sent in a special format, and checks the correctness of the username and password in different positions. When the username and password are correct, the server returns special identification information, indicating that it has entered the decoy account addition state. At this time, the next entered account credentials will be regarded as decoy account information synchronized to the server. (3) The user enters the decoy account credentials. (4) The server records the decoy account credentials into the specified user data and begins to detect the use of the decoy account. If you want to continue to add decoy account information, repeat steps (1) to (3).
[0062] Specific measures for implementing the technology of this invention: 1. When a user runs this system for the first time, the program will automatically detect the number and types of browsers installed on the user's computer. It will then search the database location where the browsers store user information and store the database location in a configuration file for later reading and adding account credentials.
[0063] 2. After the program starts running, it prompts the user to select the browser to add to the bait account. The browser list output is the information obtained from step 1 of scanning the user's computer.
[0064] 3. During the account reading phase, the program will output a prompt message, allowing the user to choose whether to read from the browser's local database or enter the information manually. If the user chooses to read from the browser's local database, the program will open the database of the browser specified in step 2 and read the account information from it; if the user chooses to enter the information manually, the user will need to input: (1) Account Name (2) Password (3) Creation time (4) Last time of use 4. After receiving account credentials from the database or user input, the program inputs the account name information into the account generation model; and performs random seed mutation on account attribute information, such as creation time and last usage time.
[0065] 5. The program displays the accounts generated in the account generation model to the user through the interface. The user can choose the bait accounts themselves or specify a number to let the program randomly select bait accounts.
[0066] 6. After selecting the bait account, the program will prompt the user to set a password for the bait account, providing three password generation methods: simple, medium, and complex. After the user selects the complexity, the program will randomly generate a password based on the account name.
[0067] 7. The program completes all the creation work of the bait accounts and inserts them into the browser database. The program outputs a prompt message, displaying the detailed data of the inserted accounts and the number of accounts inserted.
[0068] 8. Synchronize decoy account information with the server. If the target server supports the method for synchronizing decoy accounts between the client and the server proposed in this invention, this method can be used to synchronize decoy account information with the server. If it does not support it, other methods can be used to synchronize and store decoy account information with the server. For example, a script can be created on the server side to read the server login log and detect the usage of decoy accounts in the login log.
[0069] Beneficial effects: Traditional honeypot technology is currently inadequate for detecting intrusions targeting user terminals. While honeymark technology can be deployed on user terminals, it doesn't yet cover browsers, tools rich in sensitive user information, and lacks a corresponding detection system for honeymark triggers. This paper proposes a method to address the vulnerability of browser credentials by adding decoy accounts to mislead attackers and combining this with decoy account detection methods to detect intrusion activities on the user's host. This method can automatically detect the usernames in the target user's browser based on the characteristics of different user account creation methods, generating highly realistic decoy accounts and passwords. A client-server synchronization method for decoy accounts is proposed, enabling more secure synchronization of decoy account information without requiring users to run additional programs. Therefore, it has good practicality and applicability.
[0070] Device Example 1 This invention provides a schematic diagram of an apparatus for automatically generating and deploying browser bait accounts, as shown in the embodiment of the invention. Figure 5 As shown, it includes: a memory 50, a processor 52, and a computer program stored on the memory 50 and executable on the processor 52. When the computer program is executed by the processor, it implements the steps in the above method embodiments.
[0071] Device Example 2 This invention provides a computer-readable storage medium storing an information transmission implementation program, which, when executed by a processor 52, implements the steps described in the above method embodiments.
[0072] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions to the technical solutions of the embodiments of the present invention do not cause the essence of the corresponding technical solutions to deviate from the scope of the present solution.
Claims
1. A method of automated perception generation and deployment of browser decoy accounts, comprising: include: S1. Obtain the existing login credentials in the user's browser, analyze the semantics and string patterns of the user's login credentials, and generate a decoy account with semantics and string patterns similar to the login credentials in the user's browser. S2. After encrypting the bait account using the encryption API, insert it into the browser's database and store the encrypted bait account together with the user's real account password data. S3. The server synchronizes bait information and monitors the usage of bait accounts; The process of generating a decoy account with semantics and string patterns similar to the login credentials in the user's browser specifically includes: extracting semantic information contained in the account name through a semantic analysis module, abstracting and classifying the extracted semantic information, searching for potential replacement words based on different categories of semantic information, analyzing the string pattern of the account name through a string extraction module, and filling different replacement words into the position to be replaced according to the specified format by the semantic analysis module to become the final decoy account name; S2 specifically includes: encrypting the decoy account using an encryption API and inserting it into the browser's database; storing the encrypted decoy account together with the user's real account password data; and making the decoy account more realistic by directly inserting it into the database and setting its creation time, last usage time, and number of modifications. Specifically, S3 includes: reusing the API that initiates login requests from the client to the server to synchronize the information of the decoy account, and detecting the usage of the decoy account on the server side.
2. The method of claim 1, wherein, The semantic analysis module extracts semantic information contained in the username, abstracts and classifies the extracted semantic information, and searches for potential replacement words based on different categories of semantic information; the string extraction module analyzes the string pattern of the username, specifically including: the semantic information that the user wants to assign to the username when creating it. ； wherein represent different semantics, and the semantic information is abstracted into the summary information: where d j represent different summary information, by one or more derived as follows: User according to abstract Further abstracting personality trait representation words : Final user's account name By combinations of elements in: Receiving a user account name As a parameter, the user account name is received The model analysis inference individuality feature representation word is obtained by performing mode extraction, word segmentation, and word meaning extraction : Depend on inverse operation from Generate a set of sentence summaries with relevant specific semantics. : By the inverse operation of , input to obtain the semantics contained in the model inference account name : Subsequently, the model analyzes the semantics in the , selects text with replaced synonyms or similar semantics to replace, and generates : , ； Obtaining After the data is obtained, the user account creation process is mimicked Semantic summarization produces candidate strings.
3. The method of claim 2, wherein, The analysis of the account name string pattern by the string extraction module specifically includes: analyzing the account name string pattern by the string extraction module, and the string pattern includes: username length features, special character features, numeric features, keyboard input pattern features, character combination pattern features, and user uniqueness features.
4. The method of claim 3, wherein, The semantic analysis module selects different replacement words based on the string pattern and fills them into the position to be replaced in a specified form to become the final decoy account name. Specifically, it includes: extracting the string features of the username, modifying the candidate string according to the features, performing appropriate random mutations, and then concatenating the candidate strings to form the final decoy account name.
5. The method of claim 4, wherein, The semantic analysis module selects different replacement words based on the string pattern and fills them into the position to be replaced in a specified form to become the final decoy account name. It further includes: using white-box testing and black-box testing to test and evaluate the realism of the decoy account name.
6. An apparatus for automated perception generation and deployment of browser deco accounts, comprising: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the method steps of automatically generating and deploying browser decoy accounts as claimed in any one of claims 1 to 5.
7. A computer readable storage medium characterized in that, The computer readable storage medium has stored thereon an implementation program of information transmission, and the program, when executed by the processor, implements the method steps of automatically generating and deploying a browser decoy account according to any one of claims 1 to 5.