A fingerprint-based network attack behavior detection method and computer device

Abstract

The application relates to the technical field of network security, and discloses a network attack behavior detection method based on a fingerprint, a computer device and a computer readable storage medium, to solve the problem that the current network attack behavior detection method has a coarse utilization granularity for browser fingerprints. The method comprises the following steps: acquiring information collected by at least one of IP attribute fingerprints, browser attribute fingerprints, hardware attribute fingerprints and software attribute fingerprints of a same account within a set time period; determining IP conversion frequency, browser attribute fingerprint conversion frequency and software attribute fingerprint conversion frequency within a preset period according to the information collected by the IP attribute fingerprints, the browser attribute fingerprints and the software attribute fingerprints; and determining the standard deviation of a screen resolution, a Canvas canvas hash value after preprocessing and an audio hash value according to the information collected by the hardware attribute fingerprints, so as to detect abnormal login behavior of the account. The method can improve the accuracy of network attack detection on the account.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a fingerprint-based network attack behavior detection method, computer device, and computer-readable storage medium. Background Technology

[0002] Currently, browser fingerprinting technology primarily focuses on improving fingerprint collection. Its applications are mainly in identifying the same device and intelligent ad push notifications. However, it's less relevant to addressing common internet attacks such as malicious order placement, ticket fraud, malicious media attacks, and malicious advertising. For detecting business activities requiring account login, these attacks typically manifest in two ways: one is using the same account to log in from different IPs or platforms; the other is using virtual technology to simultaneously log in to multiple accounts on the same platform.

[0003] Current methods for detecting cyberattacks rarely utilize fingerprints, and their use of browser fingerprints is relatively coarse-grained with a narrow range of fingerprint attributes. Summary of the Invention

[0004] To address the issues of coarse granularity and narrow application of fingerprint attributes in current network attack detection methods, this invention provides a fingerprint-based network attack detection method, computer device, and computer-readable storage medium, which aims to improve the accuracy of detecting network attacks on accounts.

[0005] To achieve the above objectives, according to a first aspect of the present invention, a fingerprint-based network attack behavior detection method is provided, the method comprising:

[0006] This tool acquires information from at least one of the following when the same account logs in within a set time period: IP attribute fingerprint, browser attribute fingerprint, hardware attribute fingerprint, and software attribute fingerprint. The IP attribute fingerprint information includes the real IP address and IP location. The browser attribute fingerprint information includes the terminal platform type, browser type, or application software version, where the terminal platform type is the operating system type. The hardware attribute fingerprint information includes the Canvas hash value, audio hash value, and screen resolution. The software attribute fingerprint information includes time zone information and language system information.

[0007] Based on the information collected from the IP attribute fingerprint, determine the IP change frequency within a preset period;

[0008] Based on the information collected from the browser attribute fingerprint, determine the frequency of browser attribute fingerprint changes within a preset period;

[0009] Based on the information collected from the hardware attribute fingerprint, determine the screen resolution and the standard deviation of the preprocessed Canvas hash value and audio hash value;

[0010] Based on the information collected from the software attribute fingerprint, determine the software attribute fingerprint transformation frequency within a preset period;

[0011] Abnormal account login behavior is detected based on at least one of the following: IP change frequency within a preset period, browser attribute fingerprint change frequency within a preset period, screen resolution, standard deviation of preprocessed Canvas hash value and audio hash value, and software attribute fingerprint change frequency within a preset period.

[0012] Furthermore, based on at least one of the following factors within a preset period: IP address change frequency, browser attribute fingerprint change frequency, screen resolution, standard deviation of preprocessed Canvas hash value and audio hash value, and software attribute fingerprint change frequency, abnormal account login behavior is detected. This includes assigning weights to the following factors within a preset period: IP address change frequency, browser attribute fingerprint change frequency, screen resolution, standard deviation of preprocessed Canvas hash value and audio hash value, and software attribute fingerprint change frequency. The weight of the IP address change frequency within the preset period is no less than that of the screen resolution, standard deviation of preprocessed Canvas hash value, and audio hash value. The weights of the standard deviation of the hash value, screen resolution, and the standard deviations of the preprocessed Canvas hash value and audio hash value are not less than the weight of the browser attribute fingerprint change frequency within a preset period, and the weight of the browser attribute fingerprint change frequency within a preset period is not less than the weight of the software attribute fingerprint change frequency within a preset period. Based on the assigned weights, the IP change frequency, browser attribute fingerprint change frequency, screen resolution, the standard deviations of the preprocessed Canvas hash value and audio hash value, and the software attribute fingerprint change frequency within a preset period are weighted and summed to obtain the comprehensive change frequency. Based on the comprehensive change frequency, it is determined whether there is any abnormal account login behavior.

[0013] Further, based on the information collected from IP attribute fingerprints, the IP change frequency within a preset period is determined. This includes determining whether the same account switches IP addresses across regions, provinces, or countries based on the IP's location. When the IP address is within the same region, the number of IP address switches is recorded, and this number is used as the IP address change frequency within the same region. When the IP address is across regions but within the same province, the number of switches across different regions is recorded, and this number is multiplied by 10 and added to the IP address change frequency within each region to obtain the IP address change frequency across regions. When the IP address is across provinces but within the same country, the number of switches across different provinces is recorded, and this number is multiplied by 20 and added to the IP address change frequency across provinces to obtain the IP address change frequency across provinces. When the IP address is across countries, the number of switches across different countries is recorded, and this number is multiplied by 50 and added to the IP address change frequency across provinces within each country to obtain the IP address change frequency across countries. The IP address change frequency within the same region, across regions, across provinces, or across countries is divided by the corresponding preset period to obtain the IP change frequency within the corresponding preset period.

[0014] Furthermore, based on the information collected from the browser attribute fingerprint, the browser attribute fingerprint change frequency within a preset period is determined, including recording the number of changes in operating system type; recording the number of changes in browser type or application software version; multiplying the number of changes in operating system type by 10 and adding the number of changes in browser type or application software version to obtain the browser attribute fingerprint change frequency; dividing the browser attribute fingerprint change frequency by the corresponding preset period to obtain the browser attribute fingerprint change frequency within the preset period.

[0015] Furthermore, based on the information collected from the hardware attribute fingerprint, the screen resolution and the standard deviation of the preprocessed Canvas hash value and audio hash value are determined, including preprocessing the Canvas hash value and audio hash value separately; and calculating the screen resolution, the standard deviation of the preprocessed Canvas hash value and audio hash value separately.

[0016] Furthermore, based on the information collected from the software attribute fingerprint, the software attribute fingerprint transformation frequency within a preset period is determined, including recording the number of times the time zone information changes; recording the number of times the language system information changes; multiplying the number of times the time zone information changes by 20 and the number of times the language system information changes by 10, and then summing them to obtain the software attribute fingerprint transformation frequency; dividing the software attribute fingerprint transformation frequency by the corresponding preset period to obtain the software attribute fingerprint transformation frequency within the preset period.

[0017] Furthermore, the aforementioned fingerprint-based network attack detection method also includes obtaining information on IP attribute fingerprints collected when multiple accounts log in using the same fingerprint within a set time period. The information on IP attribute fingerprints includes the host IP and the real IP address. If the number of accounts with the same real IP address exceeds the account threshold, a subset with the same host IP is selected from the set of accounts with the same real IP address. If the number of accounts contained in the subset exceeds the account threshold, it is determined that at least one account in the subset has abnormal login behavior.

[0018] Furthermore, the aforementioned fingerprint-based network attack detection method also includes acquiring information on hardware attribute fingerprints collected when multiple accounts log in using the same fingerprint within a set time period. The information on hardware attribute fingerprints includes the Canvas hash value, audio hash value, screen resolution, and screen color information. Accounts with the same Canvas hash value, audio hash value, screen resolution, and screen color information are grouped into an account set. If the number of accounts in the account set exceeds the account threshold, it is determined that at least one account in the account set has abnormal login behavior.

[0019] According to a second aspect of the invention, a computer device is also provided, comprising a memory, a processor, and a computer program stored in the memory, the processor executing the computer program to implement the steps of any of the methods described above.

[0020] According to a third aspect of the invention, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed by a processor, implements the steps of any of the above methods.

[0021] In summary, compared with the prior art, the above-described technical solutions conceived by this invention can achieve the following beneficial effects:

[0022] (1) The present invention provides a fingerprint-based network attack behavior detection method. For cases where the same account switches between different IPs or platforms for login operations, it acquires fingerprint information of four attributes when the same account logs in within a set time period. Based on the IP attribute fingerprint information, it determines the IP change frequency within a preset period; based on the browser attribute fingerprint information, it determines the browser attribute fingerprint change frequency within a preset period; based on the hardware attribute fingerprint information, it determines the screen resolution and the standard deviation of the pre-processed Canvas hash value and audio hash value; based on the software attribute fingerprint information, it determines the software attribute fingerprint change frequency within a preset period. Then, based on at least one of the IP change frequency, browser attribute fingerprint change frequency, screen resolution, the standard deviation of the pre-processed Canvas hash value and audio hash value, and the software attribute fingerprint change frequency within a preset period, it detects abnormal account login behavior, thereby improving the accuracy of detecting network attacks on accounts.

[0023] (2) The present invention provides a fingerprint-based network attack behavior detection method. For the situation where multiple accounts are logged in simultaneously on the same platform using virtual technology, the method uses IP attribute fingerprint and hardware attribute fingerprint to determine abnormal login behavior of the account. It can effectively locate accounts such as malicious order brushing, malicious ticket purchase, malicious media attack, and malicious propaganda, and thus locate specific malicious behavior. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 A schematic flowchart illustrating a fingerprint-based network attack behavior detection method provided in this application embodiment;

[0026] Figure 2 This is a schematic diagram of the internal structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0028] The terms "first," "second," "third," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or apparatuses.

[0029] like Figure 1 As shown, a fingerprint-based network attack detection method is provided. This method can be executed by a terminal or by a server communicating with the terminal via a network. The terminal can be, but is not limited to, various personal computers, laptops, smartphones, tablets, etc. The server can be a standalone server or a server cluster consisting of multiple servers. Taking the application of this method to a terminal as an example, the following steps are included:

[0030] Step 101: Obtain information collected from at least one of the following when the same account logs in within a set time period: IP attribute fingerprint, browser attribute fingerprint, hardware attribute fingerprint, and software attribute fingerprint.

[0031] The information collected by the IP attribute fingerprint includes the real IP address and IP location. The information collected by the browser attribute fingerprint includes the terminal platform type, browser type or application software version, with the terminal platform type being the operating system type. The information collected by the hardware attribute fingerprint includes the Canvas hash value, audio hash value, screen resolution, CPU model, motherboard chipset model, memory size and model, and hard drive size and type. The information collected by the software attribute fingerprint includes time zone information and language system information.

[0032] In one embodiment, the terminal collects fingerprint-related information when a user logs in with the same account within a set time period using an SDK (Software Development Kit), including at least one type of fingerprint-related information such as IP attribute fingerprint, browser attribute fingerprint, hardware attribute fingerprint, and software attribute fingerprint.

[0033] In one embodiment, the terminal and the user terminal (e.g., PC, mobile phone, or tablet) are connected in communication. The user terminal collects fingerprint-related information when the user logs in with the same account within a set time period using an SDK (Software Development Kit). This includes at least one type of fingerprint-related information, such as IP attribute fingerprint, browser attribute fingerprint, hardware attribute fingerprint, and software attribute fingerprint. The user terminal then sends the collected fingerprint-related information to the terminal.

[0034] Step 102: Determine the IP change frequency within a preset period based on the information collected from the IP attribute fingerprint.

[0035] Step 103: Determine the browser attribute fingerprint change frequency within a preset period based on the information collected from the browser attribute fingerprint.

[0036] Step 104: Based on the information collected from the hardware attribute fingerprint, determine the screen resolution and the standard deviation of the preprocessed Canvas hash value and audio hash value.

[0037] Step 105: Determine the software attribute fingerprint transformation frequency within a preset period based on the information collected from the software attribute fingerprint.

[0038] Step 106: Detect abnormal account login behavior based on at least one of the following: IP change frequency within a preset period, browser attribute fingerprint change frequency within a preset period, screen resolution, standard deviation of preprocessed Canvas hash value and audio hash value, and software attribute fingerprint change frequency within a preset period.

[0039] For example, if the IP change frequency, browser attribute fingerprint change frequency, screen resolution, and standard deviation of preprocessed Canvas hash value and audio hash value are obtained within a preset period, or if the software attribute fingerprint change frequency is obtained within a preset period, the terminal sets a corresponding threshold according to the actual business situation. If the IP change frequency, browser attribute fingerprint change frequency, screen resolution, preprocessed Canvas hash value, standard deviation of preprocessed audio hash value, or software attribute fingerprint change frequency exceeds the corresponding threshold within the preset period, it indicates that the account has abnormal login behavior.

[0040] Given the IP change frequency, browser attribute fingerprint change frequency, screen resolution, standard deviation of preprocessed Canvas hash value and audio hash value, and software attribute fingerprint change frequency within a preset period, the terminal assigns weights to these factors: IP change frequency, browser attribute fingerprint change frequency, screen resolution, standard deviation of preprocessed Canvas hash value and audio hash value, and software attribute fingerprint change frequency within a preset period. The weight of the IP change frequency within the preset period is no less than that of the screen resolution and the standard deviation of the preprocessed Canvas hash value and audio hash value. The weights of screen resolution and the standard deviation of the preprocessed Canvas hash value and audio hash value are no less than the weight of the browser attribute fingerprint change frequency within a preset period, and the weight of the browser attribute fingerprint change frequency within a preset period is no less than the weight of the software attribute fingerprint change frequency within a preset period. Based on the assigned weights, the IP change frequency, browser attribute fingerprint change frequency, screen resolution, the standard deviation of the preprocessed Canvas hash value and audio hash value, and the software attribute fingerprint change frequency within a preset period are weighted and summed to obtain the comprehensive change frequency. Based on the comprehensive change frequency, it is determined whether there is any abnormal account login behavior.

[0041] In the aforementioned fingerprint-based network attack detection method, for cases where the same account switches between different IPs or platforms to log in, it acquires fingerprint information of four attributes when the same account logs in within a set time period. Based on the IP attribute fingerprint information, it determines the IP change frequency within a preset period; based on the browser attribute fingerprint information, it determines the browser attribute fingerprint change frequency within a preset period; based on the hardware attribute fingerprint information, it determines the screen resolution and the standard deviation of the pre-processed Canvas hash value and audio hash value; based on the software attribute fingerprint information, it determines the software attribute fingerprint change frequency within a preset period. Then, based on at least one of the following—IP change frequency, browser attribute fingerprint change frequency, screen resolution, the standard deviation of the pre-processed Canvas hash value and audio hash value, and software attribute fingerprint change frequency—abnormal account login behavior is detected, thereby improving the accuracy of detecting network attacks against accounts.

[0042] In one embodiment, for the detection of business behaviors requiring account login access, the main fingerprint types detected include (i) IP attribute fingerprints, (ii) browser attribute fingerprints, (iii) hardware attribute fingerprints, and (iv) software attribute fingerprints. Monitoring a single account involves monitoring the frequency or magnitude of fingerprint changes over a period of time to determine abnormal account login behavior, thereby identifying potential malicious activities such as fraudulent order placement, malicious ticket purchases, malicious media attacks, or malicious advertising.

[0043] (i) For IP attribute fingerprints, obtain the information collected by the IP attribute fingerprint when the same account logs in within a certain time period, including the real external IP address of WebRTC (Web Real-Time Communications) (i.e., not the proxy IP address, nor the IP address assigned by the router), the IP location (including the country, province, city or region where the IP is located), latitude and longitude, and login time.

[0044] Based on the information collected from IP attribute fingerprints, the IP change frequency within a preset period is determined, including the following steps:

[0045] 1) Based on the IP address location, determine whether the same account switches IP addresses across regions, provinces, or countries when logging in within a certain time period;

[0046] 2) When IP addresses are in the same area, such as a city or administrative region, record the number of IP address switching (increment by one for each switching) N1, and use the number of IP address switching as the IP address switching frequency in the same area;

[0047] 3) When an IP address spans multiple regions but is within the same province or state, record the number of times it switches between different regions, N2. Multiply N2 by 10 and add the number of times the IP address switches within the same region to obtain the number of times the IP address switches across regions.

[0048] 4) When an IP address spans multiple provinces but is within the same country, record the number of times it switches between different provinces, N3. Multiply N3 by 20 and add the IP address cross-regional change frequency within each province to obtain the IP address cross-province change frequency.

[0049] 5) When an IP address spans multiple countries, record the number of times it switches between different countries, N4. Multiply N4 by 50 and add the number of times the IP address switches across provinces within each country to obtain the number of times the IP address switches across countries.

[0050] 6) Divide the calculated IP conversion frequency within the same region, IP conversion frequency across regions, IP conversion frequency across provinces, or IP conversion frequency across countries by the corresponding preset period T to obtain the IP conversion frequency within the corresponding preset period T.

[0051] 7) Compare the IP change frequency within the preset period T with the frequency threshold set by the user according to the actual situation. If the frequency threshold is exceeded, it indicates that the account has abnormal login behavior of maliciously switching IPs.

[0052] (ii) For browser attribute fingerprints, information collected from the browser attribute fingerprints of the same account logging in within a certain time period is obtained, including terminal platform type, browser type (e.g., Chrome 20.3, Firefox 16.2) or application software app version (e.g., Weibo 6.0). The terminal platform type is the operating system type (e.g., Windows 10, Linux Ubuntu 16.16). These two types of information are used to record the user's operating environment when logging in. Among them, the operating system type is used for coarse classification, and the browser type or application software app version is used for fine classification.

[0053] When the operating system type changes, it is determined that the user changed devices when logging into the account; when the operating system type does not change but the browser type or application software version changes, it is determined that the user changed the browser or the application software version (such as upgrading or uninstalling and reinstalling other versions of the app).

[0054] Based on the information collected from browser attribute fingerprints, the frequency of browser attribute fingerprint changes within a preset period is determined, including the following steps:

[0055] 1) Record the number of times the operating system type changes, N1, and increment N1 by 1 for each change;

[0056] 2) Record the number of times the browser type or application software version changes, N2, and increment N2 by 1 for each change;

[0057] 3) Multiply the number of changes in operating system type by 10 and add the number of changes in browser type or application software version to get the browser attribute fingerprint change frequency, i.e., 10*N1+N2.

[0058] 4) Divide the browser attribute fingerprint change frequency by the corresponding preset period T to obtain the browser attribute fingerprint change frequency within the preset period T, i.e., M = (10 * N1 + N2) / T.

[0059] 5) Compare the browser attribute fingerprint change frequency M within the preset period T with the frequency threshold set by the user according to the actual situation. If M exceeds the frequency threshold, it indicates that the account has abnormal login behavior such as maliciously switching devices or browsers or maliciously updating app versions.

[0060] (iii) For hardware attribute fingerprints, obtain information on hardware attribute fingerprints collected when the same account logs in within a certain time period, including Canvas hash value, audio hash value, screen resolution, and screen color information.

[0061] Based on the information collected from hardware attribute fingerprints, the screen resolution and the standard deviation of the preprocessed Canvas hash value and audio hash value are determined, including the following steps:

[0062] 1) Preprocess the Canvas hash value and audio hash value separately: take the middle 4 to 8 bytes of the Canvas hash value and audio hash value;

[0063] 2) Calculate the standard deviation of the preprocessed Canvas hash value (denoted as P1), the standard deviation of the preprocessed audio hash value (denoted as P2), and the standard deviation of the screen resolution (denoted as P3) respectively;

[0064] 3) If any of P1, P2, or P3 fluctuates beyond the standard deviation threshold set by the user based on the actual situation, it indicates that the account has abnormal login behavior.

[0065] (iv) For software attribute fingerprints, obtain information collected by the software attribute fingerprints when the same account logs in within a certain time period, including time zone information and language system information.

[0066] Based on the information collected from the software attribute fingerprint, the software attribute fingerprint transformation frequency within a preset period is determined, including the following steps:

[0067] 1) Record the number of time zone changes N1, incrementing N1 by 1 for each change;

[0068] 2) Record the number of transformations N2 of the language system information; increment N2 by 1 for each transformation.

[0069] 3) Multiply the number of times the time zone information changes by 20, multiply the number of times the language system information changes by 10, and then sum them to obtain the software attribute fingerprint change frequency, i.e., 20*N1+10*N2.

[0070] 4) Divide the software attribute fingerprint transformation frequency by the corresponding preset period T to obtain the software attribute fingerprint transformation frequency within the preset period T: M = (20*N1 + 10*N2) / T;

[0071] 5) If M is greater than the threshold set by the user based on the actual situation, it indicates that the account has abnormal login behavior.

[0072] When monitoring the above four types of abnormal account login behavior simultaneously, in order to reduce the false alarm rate, weights can be assigned to the fingerprint change frequency or standard deviation of the four types of abnormal account login behavior, and then a weighted sum can be performed to determine whether there is abnormal account login behavior.

[0073] Regarding weight allocation, IP attribute fingerprint >= hardware attribute fingerprint >= browser attribute fingerprint >= software attribute fingerprint. For example, if the weights are divided according to a 10-point ratio, the weight allocation can be 3.5:2.5:2:2.

[0074] Regarding threshold settings, different business areas require different threshold settings. For example, business systems that support login from multiple devices with the same account need to have higher thresholds, while systems that only target mobile platforms can have lower thresholds.

[0075] Monitoring multiple accounts logging in under the same fingerprint indicates that a user is operating multiple accounts simultaneously. Combined with monitoring of business content on the business side, it can be determined whether multiple accounts are engaging in malicious behavior. For example, if multiple accounts simultaneously publish the same content and log in under the same IP attribute fingerprint and hardware attribute fingerprint, it is considered malicious behavior.

[0076] In one embodiment, for abnormal account login behavior where multiple accounts simultaneously log in to the same platform using virtual technology, the fingerprint-based network attack detection method further includes:

[0077] 1) Obtain information on IP attribute fingerprints collected when multiple accounts log in using the same fingerprint within a set time period. The information on IP attribute fingerprints includes the host IP and the WebRTC's external real IP address.

[0078] 2) Set an account threshold N based on business characteristics. Count accounts with the same real IP address within the same time period. If the number of accounts with the same real IP address exceeds the account threshold, select a subset of accounts with the same host IP address from the set of accounts with multiple accounts with the same real IP address. That is: denot the set of accounts with more than the account threshold as A1~An, and the set of A1~An as R; select a subset B1~Bn of accounts with the same real IP address from each set of accounts in R.

[0079] 3) If the number of accounts contained in subsets B1 to Bn exceeds the account threshold N, determine that at least one account in the subset has abnormal login behavior.

[0080] In one embodiment, for abnormal account login behavior where multiple accounts simultaneously log in to the same platform using virtual technology, the fingerprint-based network attack detection method further includes:

[0081] 1) Obtain information on hardware attribute fingerprints collected when multiple accounts log in using the same fingerprint within a set time period. The information on hardware attribute fingerprints collected includes the Canvas hash value, audio hash value, screen resolution, and screen color information.

[0082] 2) Set an account threshold N according to the business characteristics, and count the Canvas hash value, audio hash value, screen resolution, and screen color information of each account. Accounts with the same Canvas hash value, audio hash value, screen resolution, and screen color information are grouped into an account set A1~An, and the set A1~An is denoted as R.

[0083] 3) If the number of accounts contained in the account set R exceeds the account threshold N, determine that at least one account in the account set has abnormal login behavior.

[0084] In this embodiment, for the behavior of logging into multiple accounts simultaneously on the same platform using virtual technology, abnormal login behavior can be judged by IP attribute fingerprint and hardware attribute fingerprint. This can effectively locate accounts such as those engaging in malicious order brushing, malicious ticket purchases, malicious media attacks, and malicious propaganda, thereby locating specific malicious behaviors and facilitating evidence collection.

[0085] This application also provides a computer device, the internal structure of which can be shown in the following diagram: Figure 2 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a fingerprint-based network attack detection method.

[0086] Those skilled in the art will understand that Figure 2 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0087] like Figure 2As shown, this application also provides a computer device, which includes a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps in the above-described method embodiments.

[0088] This application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the above-described method embodiments. The computer-readable storage medium may include, but is not limited to, any type of disk, including floppy disks, optical disks, DVDs, CD-ROMs, microdrives, as well as magneto-optical disks, ROMs, RAMs, EPROMs, EEPROMs, DRAMs, VRAMs, flash memory devices, magnetic cards or optical cards, nanosystems (including molecular memory ICs), or any type of medium or device suitable for storing instructions and / or data.

[0089] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data shall comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0090] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0091] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0092] The above description is merely an exemplary embodiment of this disclosure and should not be construed as limiting the scope of this disclosure. Any equivalent changes and modifications made in accordance with the teachings of this disclosure shall still fall within the scope of this disclosure. Those skilled in the art will readily conceive of embodiments of this disclosure upon considering the specification and practicing the disclosure herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not described herein. The specification and embodiments are to be considered exemplary only, and the scope and spirit of this disclosure are defined by the claims.

[0093] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0094] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A fingerprint-based method for detecting network attack behavior, characterized in that, For situations where the same account logs in from different IP addresses or platforms, the method includes: The system acquires information collected from at least one of the following when the same account logs in within a set time period: IP attribute fingerprint, browser attribute fingerprint, hardware attribute fingerprint, and software attribute fingerprint. The IP attribute fingerprint information includes the real IP address and IP location. The browser attribute fingerprint information includes the terminal platform type, browser type, or application software version, where the terminal platform type is the operating system type. The hardware attribute fingerprint information includes the Canvas hash value, audio hash value, and screen resolution. The software attribute fingerprint information includes time zone information and language system information. Based on the information collected from IP attribute fingerprints, the IP change frequency within a preset period is determined. Specifically, this includes: determining whether the same account switches IP addresses across regions, provinces, or countries based on IP location; when IP addresses are within the same region, recording the number of IP address switches, and using this number as the same-region IP change frequency; when IP addresses are across regions but within the same province, multiplying the number of switches in different regions by 10 and adding it to the same-region IP change frequency within each region to obtain the cross-region IP change frequency; when IP addresses are across provinces but within the same country, multiplying the number of switches in different provinces by 20 and adding it to the cross-region IP change frequency within each province to obtain the cross-province IP change frequency; when IP addresses are across countries, multiplying the number of switches in different countries by 50 and adding it to the cross-province IP change frequency within each country to obtain the cross-country IP change frequency; and dividing the same-region IP change frequency, cross-region IP change frequency, cross-province IP change frequency, or cross-country IP change frequency by the corresponding preset period to obtain the IP change frequency within the corresponding preset period. Based on the information collected from the browser attribute fingerprint, determine the frequency of browser attribute fingerprint changes within a preset period; Based on the information collected from the hardware attribute fingerprint, the screen resolution and the standard deviation of the preprocessed Canvas hash value and audio hash value are determined. Before calculating the standard deviation, the Canvas hash value and the audio hash value are preprocessed respectively. The preprocessing includes taking the middle 4 to 8 bytes of the Canvas hash value and the audio hash value. Based on the information collected from the software attribute fingerprint, determine the software attribute fingerprint transformation frequency within a preset period; Weights are assigned to the IP change frequency, browser attribute fingerprint change frequency, screen resolution, standard deviation of preprocessed Canvas hash value and audio hash value, and software attribute fingerprint change frequency within the preset period. The weight of the IP change frequency within the preset period is no less than the weight of the screen resolution, standard deviation of preprocessed Canvas hash value and audio hash value, the weight of the screen resolution, standard deviation of preprocessed Canvas hash value and audio hash value, and the weight of the browser attribute fingerprint change frequency within the preset period are all no less than the weight of the software attribute fingerprint change frequency within the preset period. Based on the assigned weights, the IP transformation frequency within the preset period, the browser attribute fingerprint transformation frequency within the preset period, the screen resolution, the standard deviation of the preprocessed Canvas hash value and audio hash value, and the software attribute fingerprint transformation frequency within the preset period are weighted and summed to obtain the comprehensive transformation frequency. Based on the comprehensive transformation frequency, it is determined whether there is any abnormal account login behavior.

2. The method as described in claim 1, characterized in that, The step of determining the browser attribute fingerprint change frequency within a preset period based on the information collected from the browser attribute fingerprint includes: Record the number of times the operating system type changes; Record the number of times the browser type or application software version changes; Multiply the number of changes in the operating system type by 10 and add the number of changes in the browser type or application software version to obtain the browser attribute fingerprint change frequency. Divide the browser attribute fingerprint change frequency by the corresponding preset period to obtain the browser attribute fingerprint change frequency within the preset period.

3. The method as described in claim 1, characterized in that, The step of determining the software attribute fingerprint change frequency within a preset period based on the information collected from the software attribute fingerprint includes: Record the number of times the time zone information changes; Record the number of transformations of language system information; Multiply the number of transformations of the time zone information by 20, multiply the number of transformations of the language system information by 10, and then sum them to obtain the software attribute fingerprint transformation frequency. Divide the software attribute fingerprint transformation frequency by the corresponding preset period to obtain the software attribute fingerprint transformation frequency within the preset period.

4. A computer device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the method according to any one of claims 1-3.

5. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the steps of the method according to any one of claims 1-3.

Images