Identity judgment system based on multiple sources

Abstract

The invention discloses an identity judgment system based on multiple sources, which comprises a sandbox module used for providing an isolated virtualized operation environment for suspicious operation; the equipment fingerprint module is used for obtaining fingerprint information corresponding to the suspicious operation when the suspicious operation runs in the sandbox module, and the fingerprint information comprises equipment fingerprint information, browser fingerprint information, IP information and geographical location information; and the identity confirmation module is used for comparing the fingerprint information acquired by the equipment fingerprint module with fingerprint information stored in a historical database so as to confirm the identity of the current suspicious operator. According to the multi-source-based identity judgment system, fingerprint information, browser fingerprint information, IP information and geographical location information are captured through the sandbox and are compared with historical data, so that the identity information of an attacker is confirmed.

Description

Technical Field

[0001] The present invention particularly relates to an identity determination system based on multiple sources. Background Art

[0002] Existing IP address security detection technology has the following shortcomings: it is difficult to uniformly store and analyze multiple intelligence sources; it is impossible to effectively combine device fingerprints, browser information and attacker IP for comprehensive analysis to determine malicious attack behavior; it is difficult to accurately confirm the attacker's geographic location and identity. These shortcomings lead to low efficiency in responding to malicious attacks and limited defense effects. Summary of the invention

[0003] The present invention provides a multi-source based identity determination system to solve the above-mentioned technical problems, and specifically adopts the following technical solutions:

[0004] A multi-source based identity determination system, comprising:

[0005] Sandbox module, used to provide an isolated virtualized operating environment for suspicious operations;

[0006] A device fingerprint module, used to obtain fingerprint information corresponding to a suspicious operation when the suspicious operation is executed in the sandbox module, wherein the fingerprint information includes device fingerprint information, browser fingerprint information, IP information and geographic location information;

[0007] The identity confirmation module is used to compare the fingerprint information obtained by the device fingerprint module with the fingerprint information stored in the historical database to confirm the identity of the current suspicious operator.

[0008] Furthermore, the device fingerprint module includes:

[0009] Fingerprint collection engine, used to extract device fingerprint information, browser fingerprint information, IP information and geographic location information from the suspicious operator's device;

[0010] A fingerprint generator is used to analyze the extracted raw fingerprint information and generate a unique device fingerprint;

[0011] Fingerprint database is used to store and manage all collected fingerprint information.

[0012] Furthermore, the fingerprint collection engine uses the navigator object through JavaScript to obtain the browser user agent, platform information, language, plug-in and screen information, and uses os.networkInterfaces to obtain the network interface list to extract the MAC address and IP address.

[0013] Furthermore, the device fingerprint module also includes:

[0014] The data processing unit is used to pre-process the extracted original fingerprint information.

[0015] Furthermore, the data processing unit performs standardization and cleaning processing on the extracted original fingerprint information, removes blank values ​​and sorts array data to ensure uniform numerical units.

[0016] Furthermore, the identity confirmation module comprises:

[0017] The device fingerprint comparison unit is used to calculate the similarity between the fingerprint information obtained by the device fingerprint module and the fingerprint information stored in the historical database. If the similarity exceeds a preset threshold, it is determined to be the same device without additional verification.

[0018] Furthermore, the preset threshold is 50%.

[0019] Furthermore, the multi-source based identity determination system further comprises:

[0020] A behavior data acquisition module, used for acquiring operation behavior characteristics corresponding to the suspicious operation when the suspicious operation is executed in the sandbox module;

[0021] The identity confirmation module also includes:

[0022] The behavior analysis unit is used to analyze the user's operation behavior characteristics to further verify the user's identity when the device fingerprint comparison unit fails to match the same device.

[0023] Furthermore, the operation behavior characteristics include keyboard input mode and mouse click behavior.

[0024] Furthermore, the identity confirmation module also includes:

[0025] The risk assessment unit is used to monitor geographic location changes and IP address anomalies and assess the risk level of user logins or operations.

[0026] The benefit of the present invention lies in that the multi-source-based identity determination system provided captures fingerprint information, browser fingerprint information, IP information and geographic location information through a sandbox, and compares it with historical data to confirm the real person information of the attacker. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0028] Figure 1 It is a schematic diagram of a multi-source based identity determination system of the present invention. DETAILED DESCRIPTION

[0029] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0030] like Figure 1 The figure shows a multi-source based identity determination system of the present application, which includes: a sandbox module, a device fingerprint module and an identity confirmation module.

[0031] The sandbox module is used to provide an isolated virtualized operating environment for suspicious operations. Through the virtualized environment or isolation mechanism, suspicious or malicious operations are executed in a controlled environment, thereby ensuring that their behavior does not affect the security of the actual system. In the sandbox module, sandbox technology is used to guide attackers to perform malicious operations or access fake controlled systems, thereby monitoring and capturing relevant information of the device.

[0032] The device fingerprint module is used to obtain fingerprint information from different sources corresponding to suspicious operations when the suspicious operations are running in the sandbox module. The fingerprint information includes device fingerprint information, browser fingerprint information, IP information and geographic location information. Specifically, when malicious behavior or attacks are triggered, the attacker's behavior is directed to the virtual sandbox environment. Through the isolated environment, the system can collect the attacker's device fingerprint data, browser fingerprint information, IP information and geographic location information without risk, including but not limited to hardware attributes (such as CPU, memory, disk), operating system information, browser configuration, network settings, time zone, language settings, etc. Even if the attacker uses a proxy or hides the IP on the network, the device fingerprint can still help accurately identify his identity.

[0033] The identity confirmation module is used to compare the fingerprint information obtained by the device fingerprint module with the fingerprint information stored in the historical database to confirm the identity of the current suspicious operator and determine whether the device has been identified.

[0034] In an embodiment of the present application, the device fingerprint module includes:

[0035] The fingerprint collection engine is used to extract device fingerprint information, browser fingerprint information, IP information and geographic location information from the suspicious operator's device, and is responsible for extracting relevant hardware, software, and network-level device feature information from the attacker's device. In the implementation of the present application, the fingerprint collection engine uses JavaScript to use the navigator object to obtain the browser user agent, platform information, language, plug-in and screen information, and uses os.networkInterfaces to obtain the network interface list to extract the MAC address and IP address. The MAC address is the physical address of the device and is unique. After acquisition, a unique identifier is generated through a hash algorithm.

[0036] The fingerprint generator is used to analyze the extracted raw fingerprint information and generate a unique device fingerprint. The fingerprint database is used to store and manage all collected fingerprint information for subsequent query, association and analysis.

[0037] In an embodiment of the present application, the device fingerprint module further includes: a data processing unit.

[0038] The data processing unit is used to pre-process the extracted raw fingerprint information. In order to ensure the consistency of feature data, the data processing unit will perform standardized cleaning on the collected data, remove blank values ​​and sort array data to ensure the uniformity of numerical units. The data pre-processing stage ensures that the device fingerprint remains stable in multiple sessions and is not affected by short-term device changes or feature order changes.

[0039] In an embodiment of the present application, the identity confirmation module includes a device fingerprint comparison unit.

[0040] The device fingerprint comparison unit is used to calculate the similarity between the fingerprint information obtained by the device fingerprint module and the fingerprint information stored in the historical database. If the similarity exceeds a preset threshold, it is determined to be the same device without additional verification. In the implementation of the present application, the preset threshold is 50%.

[0041] When the matching process confirms that the new data is highly similar to the threat information stored in the historical database, it will be determined that the data belongs to a "real person intelligence source". The data is further classified and marked, indicating that they may belong to real threat intelligence sources for further processing and storage. Subsequently, the "real person intelligence source" that has been analyzed and confirmed will be stored in the real person threat intelligence platform. This includes marking the device fingerprint, IP address, geographic location and other data for further use by the security system.

[0042] Specifically, the fingerprint features are converted into vector form through the Jaccard similarity method, and the similarity between the captured fingerprint and the historical fingerprint is calculated to determine whether there are duplicate devices, that is, the ratio of the intersection and union of the two fingerprint feature values, and their similarity scores are obtained. A threshold of 50% is preset. If the similarity exceeds this threshold, the fingerprints are considered similar and are judged to be the same device. Among them, IP addresses and browsers may be more likely to change, while hardware information (such as GPU or CPU) is relatively stable. Different weights are set for different features to increase the accuracy of the model. Based on the Jaccard similarity algorithm, identify which devices, IP addresses or geographic locations have been stored before.

[0043] In the implementation mode of the present application, the identity confirmation module includes an association analysis unit. The captured fingerprint and attack behavior are associated and analyzed to help determine the attack source and attack behavior. The captured fingerprint information is compared with the historical fingerprint data in the database to identify whether there are duplicate devices or attackers use the same device to launch attacks. At the same time, by comparing the fingerprint information of multiple devices, it is analyzed whether there are similar behavior patterns of different devices or the same attacker launches attacks through multiple devices.

[0044] In the implementation of the present application, the multi-source identity determination system further includes: a behavior data acquisition module. The behavior data acquisition module is used to obtain the operation behavior characteristics corresponding to the suspicious operation when the suspicious operation is running in the sandbox module. The operation behavior characteristics include keyboard input mode and mouse click behavior.

[0045] The identity confirmation module also includes a behavior analysis unit.

[0046] The behavior analysis unit is used to analyze the user's operation behavior characteristics to further verify the user's identity when the device fingerprint comparison unit fails to match the same device.

[0047] In an implementation manner of the present application, the identity confirmation module further includes: a risk assessment unit.

[0048] The risk assessment unit is used to monitor geographic location changes and IP address anomalies to assess the risk level of user logins or operations. If the risk is too high, the module will require further identity verification.

[0049] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the above embodiments do not limit the present invention in any form, and any technical solution obtained by equivalent replacement or equivalent transformation falls within the protection scope of the present invention.

Claims

1. A multi-source based identity determination system, characterized in that: Include: Sandbox module, used to provide an isolated virtualized operating environment for suspicious operations; A device fingerprint module, used to obtain fingerprint information corresponding to a suspicious operation when the suspicious operation is executed in the sandbox module, wherein the fingerprint information includes device fingerprint information, browser fingerprint information, IP information and geographic location information; The identity confirmation module is used to compare the fingerprint information obtained by the device fingerprint module with the fingerprint information stored in the historical database to confirm the identity of the current suspicious operator.

2. The multi-source based identity determination system according to claim 1, characterized in that: The device fingerprint module includes: Fingerprint collection engine, used to extract device fingerprint information, browser fingerprint information, IP information and geographic location information from the suspicious operator's device; A fingerprint generator is used to analyze the extracted raw fingerprint information and generate a unique device fingerprint; Fingerprint database is used to store and manage all collected fingerprint information.

3. The multi-source based identity determination system according to claim 2, characterized in that: The fingerprint collection engine uses the navigator object through JavaScript to obtain the browser user agent, platform information, language, plug-in and screen information, and uses os.networkInterfaces to obtain the network interface list to extract the MAC address and IP address.

4. The multi-source based identity determination system according to claim 2, characterized in that: The device fingerprint module also includes: The data processing unit is used to pre-process the extracted original fingerprint information.

5. The multi-source based identity determination system according to claim 4, characterized in that: The data processing unit performs standardization and cleaning processing on the extracted original fingerprint information, removes blank values ​​and sorts array data to ensure uniform numerical units.

6. The multi-source based identity determination system according to claim 1, characterized in that: The identity confirmation module comprises: The device fingerprint comparison unit is used to calculate the similarity between the fingerprint information obtained by the device fingerprint module and the fingerprint information stored in the historical database. If the similarity exceeds a preset threshold, it is determined to be the same device without additional verification.

7. The multi-source based identity determination system according to claim 6, characterized in that: The default threshold is 50%.

8. The multi-source based identity determination system according to claim 6, characterized in that: The multi-source based identity determination system further comprises: A behavior data acquisition module, used for acquiring operation behavior characteristics corresponding to the suspicious operation when the suspicious operation is executed in the sandbox module; The identity confirmation module also includes: The behavior analysis unit is used to analyze the user's operation behavior characteristics to further verify the user's identity when the device fingerprint comparison unit fails to match the same device.

9. The multi-source based identity determination system according to claim 8, characterized in that: The operation behavior characteristics include keyboard input mode and mouse click behavior.

10. The multi-source based identity determination system according to claim 6, characterized in that: The identity confirmation module also includes: The risk assessment unit is used to monitor geographic location changes and IP address anomalies and assess the risk level of user logins or operations.

Images