Fingerprint-based network attack behavior detection method and computer equipment

Abstract

The invention relates to the technical field of network security, and discloses a network attack behavior detection method based on fingerprints, computer equipment and a computer readable storage medium in order to solve the problem that the utilization granularity of browser fingerprints in an existing network attack behavior detection method is coarse. The method comprises the steps of obtaining information collected by at least one of an IP attribute fingerprint, a browser attribute fingerprint, a hardware attribute fingerprint and a software attribute fingerprint when the same account logs in within a set time period; according to information collected by the IP attribute fingerprint, the browser attribute fingerprint and the software attribute fingerprint, respectively determining an IP conversion frequency, a browser attribute fingerprint conversion frequency and a software attribute fingerprint conversion frequency in a preset period; and according to the information acquired by the hardware attribute fingerprint, determining the standard deviation of the screen resolution, the preprocessed Canvas hash value and the audio hash value, and further detecting the abnormal login behavior of the account. By adopting the method, the accuracy of network attack detection of the account can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and more specifically, to a fingerprint-based network attack behavior detection method, a computer device, and a computer-readable storage medium. Background Art

[0002] At present, browser fingerprint recognition technology is mainly aimed at improving fingerprint collection. The application of fingerprint technology is mainly in the field of identifying the same device and intelligent advertising push. However, some network attacks on the Internet, such as malicious order brushing, malicious ticket purchase, malicious media attack, malicious propaganda, etc., are rarely involved in applications based on browser fingerprints. For the detection of business behaviors that require account login access, these network attacks generally have two manifestations: one is that the same account switches to different IPs or platforms for login operations, and the other is that the same platform uses virtual technology to log in to multiple accounts at the same time for operation.

[0003] Current network attack behavior detection methods rarely use fingerprints, and the granularity of browser fingerprint utilization is relatively coarse, and the use of fingerprint attributes is relatively narrow. Summary of the invention

[0004] In order to solve the problem that the current network attack behavior detection methods have coarse granularity in the use of browser fingerprints and narrow use of fingerprint attributes, the present invention provides a fingerprint-based network attack behavior detection method, computer device and computer-readable storage medium, which can improve the accuracy of account network attack behavior detection.

[0005] To achieve the above object, according to a first aspect of the present invention, a fingerprint-based network attack behavior detection method is provided, the method comprising:

[0006] Obtain information collected from at least one of the IP attribute fingerprint, browser attribute fingerprint, hardware attribute fingerprint, and software attribute fingerprint when the same account logs in within a set time period; the information collected from the IP attribute fingerprint includes the real IP address and IP location; the information collected from the browser attribute fingerprint includes the terminal platform type, browser type, or application software version, where the terminal platform type is the operating system type; the information collected from the hardware attribute fingerprint includes the Canvas hash value, audio hash value, and screen resolution; the information collected from the software attribute fingerprint includes the time zone information and language system information;

[0007] Determine the IP change frequency within a preset period based on the information collected by IP attribute fingerprint;

[0008] Determine the browser attribute fingerprint change frequency within a preset period based on the information collected from the browser attribute fingerprint;

[0009] Based on the information collected from the hardware attribute fingerprint, determine the screen resolution and the standard deviation of the preprocessed Canvas hash value and audio hash value;

[0010] Determine the software attribute fingerprint change frequency within a preset period according to the information collected from the software attribute fingerprint;

[0011] Abnormal account login behavior is detected based on at least one of the IP change frequency within a preset period, the browser attribute fingerprint change frequency within a preset period, the screen resolution, the standard deviation of the preprocessed Canvas hash value and the audio hash value, and the software attribute fingerprint change frequency within a preset period.

[0012] Further, according to at least one of the IP change frequency within a preset period, the browser attribute fingerprint change frequency within a preset period, the screen resolution, the standard deviation of the preprocessed Canvas hash value and the audio hash value, and the software attribute fingerprint change frequency within a preset period, abnormal account login behavior is detected, including assigning weights to the IP change frequency within a preset period, the browser attribute fingerprint change frequency within a preset period, the screen resolution, the standard deviation of the preprocessed Canvas hash value and the audio hash value, and the software attribute fingerprint change frequency within a preset period, wherein the weight of the IP change frequency within the preset period is not less than the screen resolution, the standard deviation of the preprocessed Canvas hash value and the audio hash value, and the software attribute fingerprint change frequency within the preset period. The weight of the standard deviation of the Hash value, the weight of the standard deviation of the screen resolution and the preprocessed Canvas hash value and the audio hash value is not less than the weight of the browser attribute fingerprint change frequency within the preset period, and the weight of the browser attribute fingerprint change frequency within the preset period is not less than the weight of the software attribute fingerprint change frequency within the preset period; according to the assigned weights, the IP change frequency within the preset period, the browser attribute fingerprint change frequency within the preset period, the screen resolution and the preprocessed Canvas hash value and the audio hash value standard deviation, and the software attribute fingerprint change frequency within the preset period are weighted and summed to obtain a comprehensive change frequency; according to the comprehensive change frequency, determine whether there is abnormal account login behavior.

[0013] Further, based on the information collected by the IP attribute fingerprint, the IP change frequency within the preset period is determined, including determining whether the same account switches the IP address across regions, provinces or countries based on the IP location; when the IP address is in the same area, the number of IP address switching times is recorded, and the number of IP address switching times is used as the IP same-region change frequency; when the IP address is across regions but in the same province, the number of switching times in different regions is recorded, the number of switching times in different regions is multiplied by 10 and added to the IP same-region change frequency in each region to obtain the IP cross-region change frequency; when the IP address is across provinces but in the same country, the number of switching times in different provinces is recorded, the number of switching times in different provinces is multiplied by 20 and added to the IP cross-region change frequency in each province to obtain the IP cross-province change frequency; when the IP address is across countries, the number of switching times in different countries is recorded, the number of switching times in different countries is multiplied by 50 and added to the IP cross-province change frequency in each country to obtain the IP cross-country change frequency; the IP same-region change frequency, IP cross-region change frequency, IP cross-province change frequency or IP cross-country change frequency is divided by the corresponding preset period to obtain the IP change frequency within the corresponding preset period.

[0014] Furthermore, based on the information collected from the browser attribute fingerprint, the frequency of browser attribute fingerprint changes within a preset period is determined, including recording the number of times the operating system type changes; recording the number of times the browser type or application software version changes; multiplying the number of times the operating system type changes by 10 and adding the number of times the browser type or application software version changes to obtain the browser attribute fingerprint change frequency; dividing the browser attribute fingerprint change frequency by the corresponding preset period to obtain the browser attribute fingerprint change frequency within the preset period.

[0015] Furthermore, based on the information collected from the hardware attribute fingerprint, the screen resolution and the standard deviation of the preprocessed Canvas hash value and the audio hash value are determined, including preprocessing the Canvas hash value and the audio hash value respectively; and calculating the standard deviation of the screen resolution, the preprocessed Canvas hash value and the audio hash value respectively.

[0016] Furthermore, based on the information collected from the software attribute fingerprint, the change frequency of the software attribute fingerprint within a preset period is determined, including recording the number of changes of the time zone information; recording the number of changes of the language system information; multiplying the number of changes of the time zone information by 20, multiplying the number of changes of the language system information by 10, and then summing them up to obtain the software attribute fingerprint change frequency; dividing the software attribute fingerprint change frequency by the corresponding preset period to obtain the software attribute fingerprint change frequency within the preset period.

[0017] Furthermore, the above-mentioned fingerprint-based network attack behavior detection method also includes obtaining information collected by IP attribute fingerprints when multiple accounts use the same fingerprint to log in within a set time period, and the information collected by IP attribute fingerprints includes host IP and real IP address; when the number of accounts with the same real IP address exceeds the account threshold, a subset with the same host IP is screened out from the account set consisting of multiple accounts with the same real IP address; when the number of accounts contained in the subset exceeds the account threshold, it is determined that at least one account in the subset has abnormal login behavior.

[0018] Furthermore, the above-mentioned fingerprint-based network attack behavior detection method also includes obtaining information collected by hardware attribute fingerprints when multiple accounts use the same fingerprint to log in within a set time period, and the information collected by hardware attribute fingerprints includes Canvas canvas hash value, audio hash value, screen resolution, and screen color information; accounts with the same Canvas canvas hash value, audio hash value, screen resolution, and screen color information are grouped into an account set; when the number of accounts included in the account set exceeds the account threshold, it is determined that at least one account in the account set has abnormal login behavior.

[0019] According to a second aspect of the present invention, there is also provided a computer device, which includes a memory, a processor and a computer program stored in the memory, and the processor executes the computer program to implement the steps of any one of the above methods.

[0020] According to a third aspect of the present invention, there is also provided a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0021] In general, the above technical solutions conceived by the present invention can achieve the following beneficial effects compared with the prior art:

[0022] (1) The present invention provides a fingerprint-based network attack behavior detection method. For the case where the same account switches to different IPs or platforms for login operations, by obtaining information on fingerprint collection of four attributes when the same account logs in within a set time period, the IP change frequency within a preset period is determined according to the information on IP attribute fingerprint collection; the browser attribute fingerprint change frequency within a preset period is determined according to the information on browser attribute fingerprint collection; the screen resolution and the standard deviation of the preprocessed Canvas hash value and audio hash value are determined according to the information on hardware attribute fingerprint collection; the software attribute fingerprint change frequency within a preset period is determined according to the information on software attribute fingerprint collection; and then the abnormal login behavior of the account is detected according to at least one of the IP change frequency within the preset period, the browser attribute fingerprint change frequency within the preset period, the screen resolution and the standard deviation of the preprocessed Canvas hash value and audio hash value, and the software attribute fingerprint change frequency within the preset period, so as to achieve the purpose of improving the accuracy of the detection of network attack behaviors on the account.

[0023] (2) The present invention provides a fingerprint-based network attack behavior detection method. It uses IP attribute fingerprints and hardware attribute fingerprints to judge abnormal account login behavior when multiple accounts are logged in to the same platform using virtual technology at the same time. It can effectively locate accounts such as malicious order brushing, malicious ticket purchases, malicious media attacks, and malicious propaganda, and then locate specific malicious behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0025] Figure 1 A schematic diagram of a flow chart of a fingerprint-based network attack behavior detection method provided in an embodiment of the present application;

[0026] Figure 2 A schematic diagram of the internal structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0028] The terms "first", "second", "third", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0029] like Figure 1 As shown, a fingerprint-based network attack behavior detection method is provided, which can be executed by a terminal or by a server that communicates with the terminal through a network. The terminal can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, etc. The server can be an independent server, or a server cluster composed of multiple servers can be used. Taking the method applied to a terminal as an example, it includes the following steps:

[0030] Step 101, obtaining at least one of the IP attribute fingerprint, browser attribute fingerprint, hardware attribute fingerprint, and software attribute fingerprint collected when the same account logs in within a set time period.

[0031] Among them, the information collected by IP attribute fingerprints includes the real IP address and IP location. The information collected by browser attribute fingerprints includes the terminal platform type, browser type or application software version, and the terminal platform type is the operating system type. The information collected by hardware attribute fingerprints includes Canvas canvas hash value, audio hash value, screen resolution, CPU model, motherboard chip model, memory size and model, hard disk size and type, etc. The information collected by software attribute fingerprints includes time zone information and language system information.

[0032] In one embodiment, the terminal collects fingerprint-related information when a user logs in using the same account within a set time period in the form of SDK (Software Development Kit), including at least one type of fingerprint-related information among IP attribute fingerprint, browser attribute fingerprint, hardware attribute fingerprint, and software attribute fingerprint.

[0033] In one embodiment, the terminal and the user end (such as a PC, a mobile phone or a tablet) are connected in communication, and the user end collects fingerprint-related information of the user when logging in with the same account within a set time period in the form of SDK (Software Development Kit), including at least one type of fingerprint-related information of IP attribute fingerprint, browser attribute fingerprint, hardware attribute fingerprint, and software attribute fingerprint, and sends the collected fingerprint-related information of the user to the terminal.

[0034] Step 102, determining the IP change frequency within a preset period based on the information collected by the IP attribute fingerprint.

[0035] Step 103, determining the browser attribute fingerprint change frequency within a preset period according to the information collected from the browser attribute fingerprint.

[0036] Step 104, determining the screen resolution and the standard deviation of the preprocessed Canvas hash value and the audio hash value according to the information collected by the hardware attribute fingerprint.

[0037] Step 105: Determine the software attribute fingerprint change frequency within a preset period according to the information collected from the software attribute fingerprint.

[0038] Step 106, detect abnormal account login behavior based on at least one of the IP change frequency within a preset period, the browser attribute fingerprint change frequency within a preset period, the screen resolution, the standard deviation of the preprocessed Canvas hash value and the audio hash value, and the software attribute fingerprint change frequency within a preset period.

[0039] Exemplarily, when the IP change frequency within a preset period, the browser attribute fingerprint change frequency within a preset period, the screen resolution, and the standard deviation of the preprocessed Canvas hash value and the audio hash value, or the software attribute fingerprint change frequency within a preset period is obtained, the terminal sets the corresponding threshold according to the actual business situation. If the IP change frequency within the preset period exceeds the corresponding threshold, the browser attribute fingerprint change frequency within the preset period exceeds the corresponding threshold, the screen resolution exceeds the corresponding threshold, the preprocessed Canvas hash value exceeds the corresponding threshold, the standard deviation of the preprocessed audio hash value exceeds the corresponding threshold, or the software attribute fingerprint change frequency within the preset period exceeds the corresponding threshold, it indicates that the account has abnormal login behavior.

[0040] When the IP change frequency within a preset period, the browser attribute fingerprint change frequency within a preset period, the screen resolution, the standard deviation of the preprocessed Canvas hash value and the audio hash value, and the software attribute fingerprint change frequency within a preset period are obtained at the same time, the terminal assigns weights to the IP change frequency within the preset period, the browser attribute fingerprint change frequency within the preset period, the screen resolution, the standard deviation of the preprocessed Canvas hash value and the audio hash value, and the software attribute fingerprint change frequency within the preset period, wherein the weight of the IP change frequency within the preset period is not less than the screen resolution and the standard deviation of the preprocessed Canvas hash value and the audio hash value. The weight of the screen resolution and the standard deviation of the preprocessed Canvas hash value and the audio hash value is not less than the weight of the browser attribute fingerprint change frequency within the preset period, and the weight of the browser attribute fingerprint change frequency within the preset period is not less than the weight of the software attribute fingerprint change frequency within the preset period; according to the assigned weights, the IP change frequency within the preset period, the browser attribute fingerprint change frequency within the preset period, the screen resolution and the standard deviation of the preprocessed Canvas hash value and the audio hash value, and the software attribute fingerprint change frequency within the preset period are weighted and summed to obtain a comprehensive change frequency; according to the comprehensive change frequency, determine whether there is abnormal account login behavior.

[0041] In the above-mentioned fingerprint-based network attack behavior detection method, for the situation where the same account switches to different IPs or platforms for login operations, by obtaining the fingerprint collection information of the four attributes when the same account logs in within a set time period, the IP change frequency within a preset period is determined according to the information collected by the IP attribute fingerprint; the browser attribute fingerprint change frequency within a preset period is determined according to the information collected by the browser attribute fingerprint; the screen resolution and the standard deviation of the preprocessed Canvas hash value and the audio hash value are determined according to the information collected by the hardware attribute fingerprint; the software attribute fingerprint change frequency within a preset period is determined according to the information collected by the software attribute fingerprint; and then the abnormal login behavior of the account is detected according to at least one of the IP change frequency within the preset period, the browser attribute fingerprint change frequency within the preset period, the screen resolution and the standard deviation of the preprocessed Canvas hash value and the audio hash value, and the software attribute fingerprint change frequency within the preset period, so as to achieve the purpose of improving the accuracy of the detection of network attack behavior on the account.

[0042] In one embodiment, for detecting business behaviors that require account login access, the main types of fingerprints detected include (i) IP attribute fingerprints, (ii) browser attribute fingerprints, (iii) hardware attribute fingerprints, and (iv) software attribute fingerprints. For monitoring a single account, the frequency of fingerprint changes or fluctuations over a period of time is monitored to determine abnormal account login behavior, and then determine whether there is malicious order brushing, malicious ticket purchases, malicious media attacks, malicious propaganda, etc.

[0043] (1) For IP attribute fingerprints, obtain information collected from IP attribute fingerprints when the same account logs in within a certain period of time, including the real external IP address of WebRTC (Web Real-Time Communications) (that is, not a proxy IP address, nor an IP address assigned by a router), IP location (including the country, province, city or region where the IP is located), longitude and latitude, and login time.

[0044] Determining the IP change frequency within a preset period based on the information collected by the IP attribute fingerprint includes the following steps:

[0045] 1) Based on the IP location, determine whether the IP address of the same account is switched across regions, provinces or countries when logging in during a certain period of time;

[0046] 2) When the IP addresses are in the same area, such as a city or administrative district, the number of IP address switching times (one switching counts as one) N1 is recorded, and the number of IP address switching times is used as the IP same area change frequency;

[0047] 3) When the IP address is across regions but in the same province or state, record the number of switches in different regions N2, multiply the number of switches in different regions N2 by 10 and add the IP change frequency in the same region in each region to get the IP cross-region change frequency;

[0048] 4) When the IP address is across provinces but in the same country, record the number of switches in different provinces N3, multiply the number of switches in different provinces N3 by 20 and add the IP cross-region change frequency in each province to get the IP cross-provincial change frequency;

[0049] 5) When the IP address crosses countries, record the number of switches N4 in different countries, multiply the number of switches N4 in different countries by 50 and add the frequency of IP cross-province changes in each country to get the frequency of IP cross-country changes;

[0050] 6) Divide the calculated IP same-region change frequency, IP cross-region change frequency, IP cross-province change frequency, or IP cross-country change frequency by the corresponding preset period T to obtain the IP change frequency within the corresponding preset period T;

[0051] 7) The IP change frequency within the preset period T is compared with the frequency threshold set by the user according to the actual situation. If it exceeds the frequency threshold, it means that the account has abnormal login behavior of malicious IP switching.

[0052] (ii) For browser attribute fingerprints, obtain information collected from browser attribute fingerprints when the same account logs in within a certain period of time, including terminal platform type, browser type (such as Chrome 20.3, Firefox16.2) or application software app version (such as Weibo6.0), and the terminal platform type is the operating system type (such as Windows 10, Linux Ubuntu16.16). These two types of information are used to record the operating environment when the user logs in, among which the operating system type is used for coarse classification, and the browser type or application software app version is used for fine classification.

[0053] When the operating system type changes, it is determined that the user has changed the device when logging into the account; when the operating system type has not changed but the browser type or application software version has changed, it is determined that the user has changed the browser or changed the application software version (such as app upgrade or uninstallation and reinstallation of other versions).

[0054] Determining the browser attribute fingerprint change frequency within a preset period according to the information collected from the browser attribute fingerprint includes the following steps:

[0055] 1) Record the number of changes of the operating system type N1, and add 1 to N1 each time the type is changed;

[0056] 2) Record the number of changes N2 of browser type or application software version, and N2 is incremented by 1 each time the browser type or application software version is changed;

[0057] 3) Multiply the number of operating system type changes by 10 and add the number of browser type or application software version changes to get the browser attribute fingerprint change frequency, that is, 10*N1+N2;

[0058] 4) Divide the browser attribute fingerprint change frequency by the corresponding preset period T to obtain the browser attribute fingerprint change frequency within the preset period T, that is, M = (10*N1+N2) / T;

[0059] 5) Compare the browser attribute fingerprint change frequency M within the preset period T with the frequency threshold set by the user according to the actual situation. If M exceeds the frequency threshold, it means that the account has abnormal login behavior such as malicious switching of devices or browsers or malicious update of app versions.

[0060] (3) For hardware attribute fingerprints, obtain information collected by the hardware attribute fingerprints when the same account logs in within a certain time period, including canvas hash values, audio hash values, screen resolution, and screen color information.

[0061] Based on the information collected from the hardware attribute fingerprint, the screen resolution and the standard deviation of the preprocessed Canvas hash value and the audio hash value are determined, including the following steps:

[0062] 1) Preprocess the Canvas hash value and the audio hash value respectively: take the middle 4 to 8 bytes of the Canvas hash value and the audio hash value;

[0063] 2) Calculate the standard deviation of the preprocessed Canvas hash value (denoted as P1), the standard deviation of the preprocessed audio hash value (denoted as P2), and the standard deviation of the screen resolution (denoted as P3);

[0064] 3) When the fluctuation of one of P1, P2, and P3 exceeds the standard deviation threshold set by the user based on the actual situation, it indicates that the account has abnormal login behavior.

[0065] (iv) With respect to software attribute fingerprints, obtaining information collected from software attribute fingerprints when the same account logs in during a certain period of time, including time zone information and language system information.

[0066] Determining the software attribute fingerprint change frequency within a preset period according to the information collected from the software attribute fingerprint includes the following steps:

[0067] 1) Record the number of changes of time zone information N1, and add 1 for each change;

[0068] 2) Record the number of changes N2 of the language system information, and N2 is incremented by 1 for each change;

[0069] 3) Multiply the number of changes in the time zone information by 20, multiply the number of changes in the language system information by 10, and then sum them up to get the software attribute fingerprint change frequency, that is, 20*N1+10*N2;

[0070] 4) Divide the software attribute fingerprint change frequency by the corresponding preset period T to obtain the software attribute fingerprint change frequency within the preset period T: M = (20*N1+10*N2) / T;

[0071] 5) If M is greater than the threshold set by the user based on actual conditions, it indicates that the account has abnormal login behavior.

[0072] When the above four types of abnormal login behaviors of accounts are monitored simultaneously, in order to reduce the false alarm rate, weights can be assigned to the fingerprint change frequencies or standard deviations of the four types of abnormal login behaviors of accounts, and then the weighted sum is performed to determine whether there is abnormal login behavior of the account.

[0073] Regarding weight distribution, IP attribute fingerprint>=hardware attribute fingerprint>=browser attribute fingerprint>=software attribute fingerprint. For example, if divided according to a ratio of 10, the weight distribution can be 3.5:2.5:2:2.

[0074] Regarding threshold settings, different business areas have different threshold settings. For example, a business system that supports multiple devices logging in with the same account needs to set a high threshold, while a system that only targets mobile platform services can set a low threshold.

[0075] For the monitoring of multiple accounts logging in under the same fingerprint, in this case, it means that a user is operating multiple accounts at the same time. Combined with the business content monitoring on the business end, it can be determined whether multiple accounts have malicious behavior. For example, if multiple accounts publish the same content at the same time, and multiple accounts log in under the same IP attribute fingerprint and hardware attribute fingerprint, it is judged as malicious behavior.

[0076] In one embodiment, for abnormal account login behavior of using virtual technology to log in to multiple accounts at the same time on the same platform to perform operations, the fingerprint-based network attack behavior detection method further includes:

[0077] 1) Obtain the IP attribute fingerprint information collected when multiple accounts use the same fingerprint to log in within a set time period. The IP attribute fingerprint information collected includes the host IP and the real external IP address of WebRTC;

[0078] 2) According to the business characteristics, an account threshold N is set, and accounts with the same real IP address in the same time period are counted. When the number of accounts with the same real IP address exceeds the account threshold, a subset with the same host IP is selected from the account set consisting of multiple accounts with the same real IP address, that is, the account set with multiple accounts greater than the account threshold is recorded as A1~An, and the set of A1~An is recorded as R; and a subset B1~Bn with the same real IP address is selected from each account set in R;

[0079] 3) When the number of accounts included in the subsets B1 to Bn exceeds the account threshold N, it is determined that at least one account in the subset has abnormal login behavior.

[0080] In one embodiment, for abnormal account login behavior of using virtual technology to log in to multiple accounts at the same time on the same platform to perform operations, the fingerprint-based network attack behavior detection method further includes:

[0081] 1) Obtain the information collected by hardware attribute fingerprints when multiple accounts use the same fingerprint to log in within a set time period. The information collected by hardware attribute fingerprints includes Canvas canvas hash value, audio hash value, screen resolution, and screen color information;

[0082] 2) Set the account threshold N according to the business characteristics, count the Canvas hash value, audio hash value, screen resolution, and screen color information of each account, and group the accounts with the same Canvas hash value, audio hash value, screen resolution, and screen color information into an account set A1 to An, and record the set of A1 to An as R;

[0083] 3) When the number of accounts included in the account set R exceeds the account threshold N, it is determined that at least one account in the account set has abnormal login behavior.

[0084] In this embodiment, for the behavior of using virtual technology to log in to multiple accounts at the same time on the same platform to perform operations, the IP attribute fingerprint and hardware attribute fingerprint are used to judge the abnormal account login behavior, which can effectively locate accounts such as malicious order brushing, malicious ticket purchase, malicious media attack, and malicious propaganda, and then locate the specific malicious behavior, which facilitates evidence collection.

[0085] The present application also provides a computer device, whose internal structure diagram can be as follows: Figure 2 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a fingerprint-based network attack behavior detection method is implemented.

[0086] Those skilled in the art will understand that Figure 2 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0087] like Figure 2As shown, the present application also provides a computer device, which includes a memory, a processor, and a computer program stored in the memory, and the processor executes the computer program to implement the steps in the above-mentioned method embodiments.

[0088] The present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented. The computer-readable storage medium may include, but is not limited to, any type of disk, including a floppy disk, an optical disk, a DVD, a CD-ROM, a micro drive, and a magneto-optical disk, a ROM, a RAM, an EPROM, an EEPROM, a DRAM, a VRAM, a flash memory device, a magnetic card or an optical card, a nanosystem (including a molecular memory IC), or any type of medium or device suitable for storing instructions and / or data.

[0089] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0090] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0091] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0092] The above is only an exemplary embodiment of the present disclosure, and the scope of the present disclosure cannot be limited thereto. That is, any equivalent changes and modifications made according to the teachings of the present disclosure are still within the scope of the present disclosure. After considering the specification and practicing the disclosure here, those skilled in the art will easily think of the implementation scheme of the present disclosure. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the technical field not recorded in the present disclosure. The description and examples are only regarded as exemplary, and the scope and spirit of the present disclosure are defined by the claims.

[0093] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0094] It will be easily understood by those skilled in the art that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A fingerprint-based network attack behavior detection method, characterized in that: include: Obtain at least one of the following information collected when the same account logs in within a set time period: IP attribute fingerprint, browser attribute fingerprint, hardware attribute fingerprint, and software attribute fingerprint; The information collected by the IP attribute fingerprint includes the real IP address and IP location; the information collected by the browser attribute fingerprint includes the terminal platform type, browser type or application software version, and the terminal platform type is the operating system type; the information collected by the hardware attribute fingerprint includes the Canvas canvas hash value, audio hash value, and screen resolution; the information collected by the software attribute fingerprint includes time zone information and language system information; Determine the IP change frequency within a preset period based on the information collected by IP attribute fingerprint; Determine the browser attribute fingerprint change frequency within a preset period based on the information collected from the browser attribute fingerprint; Determine the screen resolution and the standard deviation of the preprocessed Canvas hash value and the audio hash value according to the information collected by the hardware attribute fingerprint; Determine the software attribute fingerprint change frequency within a preset period according to the information collected from the software attribute fingerprint; Abnormal account login behavior is detected based on at least one of the IP change frequency within the preset period, the browser attribute fingerprint change frequency within the preset period, the screen resolution and the standard deviation of the preprocessed Canvas hash value and audio hash value, and the software attribute fingerprint change frequency within the preset period.

2. The method according to claim 1, characterized in that The detecting abnormal account login behavior according to at least one of the IP change frequency within the preset period, the browser attribute fingerprint change frequency within the preset period, the screen resolution and the standard deviation of the preprocessed Canvas hash value and the audio hash value, and the software attribute fingerprint change frequency within the preset period includes: Weights are assigned to the IP change frequency within the preset period, the browser attribute fingerprint change frequency within the preset period, the screen resolution and the standard deviation of the preprocessed Canvas hash value and audio hash value, and the software attribute fingerprint change frequency within the preset period, wherein: The weight of the IP change frequency within the preset period is not less than the weight of the screen resolution and the standard deviation of the preprocessed Canvas hash value and the audio hash value, the weight of the screen resolution and the standard deviation of the preprocessed Canvas hash value and the audio hash value is not less than the weight of the browser attribute fingerprint change frequency within the preset period, and the weight of the browser attribute fingerprint change frequency within the preset period is not less than the weight of the software attribute fingerprint change frequency within the preset period; According to the assigned weights, weighted summation is performed on the IP change frequency within the preset period, the browser attribute fingerprint change frequency within the preset period, the screen resolution and the standard deviation of the preprocessed Canvas hash value and audio hash value, and the software attribute fingerprint change frequency within the preset period to obtain a comprehensive change frequency; Based on the comprehensive change frequency, determine whether there is any abnormal account login behavior.

3. The method according to claim 1, characterized in that Determining the IP change frequency within a preset period according to the information collected from the IP attribute fingerprint includes: Based on the IP location, determine whether the same account switches IP addresses across regions, provinces or countries; When the IP addresses are in the same area, the number of IP address switching is recorded and the number of IP address switching is used as the IP same area change frequency; When the IP address is across regions but in the same province, record the number of switches in different regions, multiply the number of switches in different regions by 10 and add the IP change frequency in the same region in each region to get the IP cross-region change frequency; When the IP address is across provinces but in the same country, record the number of switches in different provinces, multiply the number of switches in different provinces by 20 and add the IP cross-region change frequency in each province to get the IP cross-provincial change frequency; When the IP address crosses countries, record the number of switches in different countries, multiply the number of switches in different countries by 50 and add the number of IP cross-province changes in each country to get the IP cross-country change frequency; Divide the IP change frequency within the same region, the IP change frequency across regions, the IP change frequency across provinces or the IP change frequency across countries by the corresponding preset period to obtain the IP change frequency within the corresponding preset period.

4. The method according to claim 1, characterized in that The step of determining the browser attribute fingerprint change frequency within a preset period based on the information collected from the browser attribute fingerprint comprises: Record the number of changes in the operating system type; Record the number of changes to browser type or application software version; The number of changes of the operating system type is multiplied by 10 and then added to the number of changes of the browser type or application software version to obtain the browser attribute fingerprint change frequency; The browser attribute fingerprint change frequency is divided by the corresponding preset period to obtain the browser attribute fingerprint change frequency within the preset period.

5. The method according to claim 1, characterized in that Determining the screen resolution and the standard deviation of the preprocessed Canvas hash value and the audio hash value according to the information collected from the hardware attribute fingerprint includes: Preprocessing the Canvas hash value and the audio hash value respectively; The standard deviations of the screen resolution, the preprocessed Canvas hash value, and the audio hash value are calculated respectively.

6. The method according to claim 1, characterized in that The step of determining the software attribute fingerprint change frequency within a preset period based on the information collected from the software attribute fingerprint includes: Record the number of times the time zone information is changed; Record the number of changes in language system information; The number of changes of the time zone information is multiplied by 20, the number of changes of the language system information is multiplied by 10, and then the sum is calculated to obtain the software attribute fingerprint change frequency; The software attribute fingerprint change frequency is divided by the corresponding preset period to obtain the software attribute fingerprint change frequency within the preset period.

7. The method according to claim 1, characterized in that The method further comprises: Obtain information collected by IP attribute fingerprints when multiple accounts use the same fingerprint to log in within a set time period, where the information collected by IP attribute fingerprints includes the host IP and the real IP address; When the number of accounts with the same real IP address exceeds the account threshold, a subset with the same host IP address is filtered out from the account set consisting of multiple accounts with the same real IP address; When the number of accounts included in the subset exceeds the account threshold, it is determined that at least one account in the subset has abnormal login behavior.

8. The method according to claim 1, characterized in that The method further comprises: Obtain information about hardware attribute fingerprints collected when multiple accounts use the same fingerprint to log in within a set time period, where the information includes canvas hash value, audio hash value, screen resolution, and screen color information; Group accounts with the same Canvas hash value, audio hash value, screen resolution, and screen color information into an account set; When the number of accounts included in the account set exceeds the account threshold, it is determined that at least one account in the account set has abnormal login behavior.

9. A computer device, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images