Path honey ordering method and system based on browser fingerprint identification

Abstract

The invention relates to the technical field of network security, in particular to a path honey ordering method and system based on browser fingerprint identification. The invention provides a path honey click method and system based on browser fingerprint identification, and the key point is that a reverse proxy is configured for a sensitive path, the behavior of a visitor is judged, and different disguised page contents are generated. The method comprises the following steps: acquiring basic features of equipment and a browser of a visitor, performing feature cross validation machining, performing standardization processing to generate a unique and stable fingerprint ID, performing multi-dimensional dynamic danger level evaluation in combination with historical behaviors of the visitor to obtain a danger score, labeling and storing the fingerprint ID, and when the visitor visits again, performing multi-dimensional dynamic danger level evaluation on the fingerprint ID. And carrying out matching identification on the generated fingerprint ID and the stored fingerprint ID, and carrying out dynamic response according to historical behaviors and danger levels. The objective of the invention is to save the maintenance cost, accurately and effectively defend attacks and trace the source of sensitive path attackers.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and system for path honey points based on browser fingerprint recognition. Background Art

[0002] With the rapid development of the Internet, Web applications have become an indispensable part of people's daily life and work. However, with the widespread use of Web services, network security threats are also increasing, especially the attack methods against Web applications are becoming more and more complex and diverse. Attackers try to detect hidden resources in Web services, such as management backends, database management systems, or other sensitive functional interfaces, through scanning and blasting. These attacks usually rely on access to sensitive URL paths, trying to discover potential vulnerabilities by accessing these paths. Attacks against these paths have become one of the important ways of modern network intrusion.

[0003] Path scanning refers to the attacker using automated tools to try to gain unauthorized access by accessing sensitive paths that may exist in a web service in large numbers. For example, an attacker may try to access paths such as / admin, / login, / phpmyadmin, / config, etc. These paths usually represent management interfaces, database management interfaces, or other pages that store sensitive information. If the attacker finds that these paths are not properly protected, they may further try to enter the system through brute force or other means.

[0004] Dictionary attack is a common automated attack technique that uses a predefined list of paths to attempt to access a variety of server paths and check the server's response status code. If the server returns 200 (indicating successful access), the attacker knows that the path exists and may perform further attacks. If the server returns 404 (indicating that the path does not exist), the attacker will continue to try other paths. This method can efficiently test the existence of paths on the Web server and quickly discover possible attack entry points.

[0005] Since these sensitive paths are usually not accessed by normal users, potential attacks can be captured by monitoring the access behavior of these paths. Any access behavior to these paths can be regarded as a tentative attack or potential intrusion behavior.

[0006] Browser fingerprinting is a technology that creates a unique identifier by analyzing the visitor's browser and device information. This technology can collect information such as the visitor's browser, plug-in, operating system, time zone, font, screen resolution, etc., and generate a unique "fingerprint ID" based on this information to identify the visitor's device. Unlike traditional cookie tracking methods, browser fingerprinting does not rely on storing data on the visitor's device, but collects public information directly from the browser through client-side technologies such as Java Script. Since the combination of parameters such as the characteristics of the browser and its installed plug-ins is almost unique, fingerprinting technology can generate a unique ID through this combined information and track it without the user's knowledge.

[0007] Currently, browser fingerprint technology is widely used in areas such as advertising tracking and user behavior analysis. For example, online advertising companies collect browser fingerprints to identify returning visitors and deliver personalized ads based on their browsing habits. In the field of Web security, browser fingerprint technology can be used to identify and track users who visit certain specific paths.

[0008] Honeypot technology is an active defense mechanism that intentionally deploys fake systems, services, or data to attract attackers and record their behavior. Honeypot systems do not have actual business data and are usually used to trick attackers into accessing and operating, thereby helping defenders analyze attackers' behavior, tools, and intentions. Lance Spitzner, a well-known information security expert, first proposed honeypot technology in 1999 and defined its application in information security.

[0009] In recent years, with the increase of Web attacks, honeypot technology has gradually been applied to Web application security. By deploying fake Web services or pages, honeypot technology can capture the attacker's scanning and access behavior on the Web path, thereby helping to identify potential attack risks.

[0010] However, most of the Web honeypots in the prior art are limited to simulating common Web services or application environments, and it is difficult to make more accurate trapping and analysis for path scanning attacks.

[0011] Web application firewalls in existing technologies can monitor and filter HTTP requests in real time and prevent path scanning attacks. However, their defense effectiveness is heavily dependent on their rule base. Attackers can bypass the rule detection of Web application firewalls by modifying the behavior of scanning tools or developing new path scanning technologies. If the rule base of the Web application firewall is not updated in a timely manner, new path scanning methods may not be detected, resulting in missed reports and defense failure.

[0012] The dynamic URL path generation technology in the prior art prevents attackers from finding sensitive resources through path scanning, dictionary blasting or other automated tools by dynamically changing the access path of sensitive pages in Web applications. The dynamic URL path generation technology generates a unique, temporary URL path for each user or each session to avoid the path of sensitive resources being fixed. However, dynamic URL path generation requires customized development on the server side. Path generation, allocation, session management, path expiration mechanism, etc. require complex logic to ensure path security and correct access. Especially in large-scale systems, the maintenance cost of managing a large number of dynamic paths is high.

[0013] In view of the increasingly severe attacks on Web services and the shortcomings of the prior art, the present invention proposes a path honey point method based on browser fingerprint recognition, which can accurately and effectively resist attacks and trace attackers while saving maintenance costs. Summary of the invention

[0014] The purpose of the present invention is to accurately and effectively resist attacks and trace attackers while saving maintenance costs, and to improve the problems of existing technologies that are not accurate enough and difficult to maintain.

[0015] In a first aspect, the present invention provides a method for identifying path honey points based on browser fingerprint recognition, comprising the following steps:

[0016] Configure reverse proxy for sensitive paths and obtain visitor IP information;

[0017] Query the visitor's access times and risk level based on the IP information, and dynamically generate a fake page based on the query results;

[0018] The basic features of the visitor's device and browser are obtained through the fake page, and after consistency check and standardization of the basic features, they are concatenated into a string and encrypted to generate a unique fingerprint ID;

[0019] The historical behavior is queried according to the fingerprint ID and the risk level is evaluated, and the evaluation result is stored together with the fingerprint ID.

[0020] The present invention provides a method for identifying path honey points based on browser fingerprint recognition, which has the technical effects of cost saving, accuracy and effectiveness.

[0021] Optionally, when a fake page is dynamically generated from a query result, if it is the first visit, the basic page is returned; if it is the second visit, the updated disguised page is returned; if the sensitive path is frequently accessed in a short period of time, a disguised error page is returned.

[0022] Optionally, when obtaining the basic characteristics of the visitor's device and browser, the browser fingerprint script is used to call the relevant browser API using JavaScript to comprehensively collect the visitor's device, browser and network environment information.

[0023] Optionally, during the consistency check, check whether the GPU rendering capability is consistent with the Canvas drawing result, whether the logical relationship between the language setting and the time zone offset is reasonable, and whether the network environment characteristics match the device capabilities.

[0024] Optionally, during standardization, string features are formatted, language and time zone settings are formatted into a standard form, list features are sorted alphabetically to generate hash values, numeric features are normalized, and missing features are filled.

[0025] Optionally, when concatenating into a string and encrypting to generate a unique fingerprint ID, the basic features that have been standardized and consistency checked are concatenated into a string in a fixed order and the concatenated string is encrypted using a SHA-256 hash algorithm to generate a fingerprint ID of a fixed length.

[0026] Optionally, when evaluating the danger level, information such as visitor's access frequency, category labels, and path exploration patterns are comprehensively analyzed through a multi-factor weighted scoring model to generate a dynamic danger level score.

[0027] Optionally, when storing the evaluation result and the fingerprint ID, the fingerprint ID is annotated and sent to the backend through Ajax technology. The fingerprint ID and the annotation are stored in the fingerprint ID database. If the visitor visits the system again, the fingerprint script will be re-run and generate the same fingerprint ID.

[0028] In a second aspect, the present invention provides a path honeypoint system based on browser fingerprint recognition, comprising:

[0029] Reverse proxy server, used to configure reverse proxy for sensitive paths, proxying access requests and visitor information to dynamic response generation services;

[0030] Dynamic response generation service, used to dynamically generate fake pages based on the number of visits and the risk level, obtain the basic characteristics of the visitor through the fake page, perform consistency checks and standardization to regenerate the fingerprint ID, evaluate the risk level of the visitor, mark the fingerprint ID and store it in the fingerprint information database;

[0031] The fingerprint information base is used to store the visitor's fingerprint ID and annotations, query the visitor's information, and update the annotations according to the danger level assessment results of the dynamic response generation service.

[0032] The present invention provides a path honey point system based on browser fingerprint recognition, which has the technical effects of cost saving, accuracy and effectiveness.

[0033] Optionally, the reverse proxy server is connected to the dynamic response generation service, and is used to proxy the access request and visitor information to the dynamic response generation service; the dynamic response generation service is connected to the fingerprint database, and is used to store the fingerprint ID and the label in the fingerprint information database, and the fingerprint information database can update the label according to the danger level assessment result of the dynamic response generation service. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a method flow chart of the path honey point based on browser fingerprint identification provided by the present method;

[0035] Figure 2 This is a flow chart of fingerprint ID generation provided by this method. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0037] The embodiment of the present invention provides a method for identifying path honey points based on browser fingerprint recognition, comprising the following steps:

[0038] S1. Configure reverse proxy for sensitive paths and obtain visitor IP information;

[0039] S2, querying the visitor's access times and risk level according to the IP information, and dynamically generating a false page according to the query result;

[0040] S3, obtaining the basic features of the visitor's device and browser through the fake page, performing consistency check and standardization on the basic features, concatenating them into a string and encrypting them to generate a unique fingerprint ID;

[0041] S4. Query the historical behavior according to the fingerprint ID and perform risk level assessment, and store the assessment result and the fingerprint ID.

[0042] The method flow chart of the path honey point based on browser fingerprint recognition provided by this method is as follows: Figure 1 shown.

[0043] When executing S1, the reverse proxy technology is used instead of the traditional redirection technology to guide the attacker to the disguised false path page, because the redirection will explicitly change the URL path, and the attacker can easily identify the redirection behavior through the URL change, HTTP status code, etc., and then realize that there may be a trap mechanism. However, the reverse proxy does not change the URL or status code visible to the client during the request and response process. The attacker cannot find that the path is proxied or forwarded through conventional HTTP tools, making it difficult for them to detect that the request is hidden or forwarded.

[0044] The specific process is as follows: This system is deployed on a normally operating Web service A, such as an online service provided by a company, and the access address is www.xxx.com. Service A provides normal user access functions to the outside world, but does not disclose certain sensitive paths (such as / admin, / phpmyadmin, etc.). These paths are usually guessed by attackers through dictionary blasting or scanning tools, and a normal user generally does not access these special sensitive paths. Service A does not expose these sensitive paths to the outside world, but configures a reverse proxy for these paths. The role of the reverse proxy is that when it detects that a user requests to access a non-existent or undisclosed sensitive path (such as / admin), Service A will not return the traditional "404 Not Found" or "403 Forbidden" response, but will capture these requests through NGINX or other proxy servers and proxy them to the dynamic response generation service.

[0045] When executing S2, when a fake page is dynamically generated according to the query results, if it is the first visit, the basic page is returned; if it is the second visit, the updated disguised page is returned; if the sensitive path is frequently accessed in a short period of time, a disguised error page is returned.

[0046] The dynamic response strategy makes the disguised page look like a real running system. The dynamic response strategy is that the system will generate different response contents for multiple visits to the same path, making it difficult for attackers to determine whether the path is a disguised honey spot by whether the content returned by multiple visits is consistent.

[0047] For example, when it is determined that the attacker is accessing the / admin path for the first time, the dynamic response generation service will return a basic backend management login interface. This page is dynamically generated through a template and contains regular username and password input boxes. When the attacker accesses the path again, the dynamic response generation service will generate an updated disguised page based on the access status, such as adding a system status prompt above the login box: "Due to security policy updates, please ensure that your account has enabled two-factor authentication", or displaying dynamic content such as "During system maintenance, some functions may not be available" at the bottom of the page, making the page look more like a real backend system and allowing the attacker to feel the dynamic changes of the page. If the system detects that the attacker frequently accesses the path or attempts multiple sensitive paths in a short period of time, the dynamic response generation service will return a disguised error page such as "503 Service Unavailable" or "System Maintenance" to interfere with the attacker's analysis behavior.

[0048] When executing S3, the basic characteristics of the visitor's device and browser are obtained. Through the browser fingerprint script, JavaScript is used to call the relevant browser API to comprehensively collect the visitor's device, browser and network environment information.

[0049] By embedding the browser fingerprint script in the disguised page and using JavaScript to call the relevant browser API, the visitor's device, browser and network environment information is comprehensively collected. The feature cross-verification mechanism is combined to capture the attacker's disguised behavior and identify whether it is an ordinary user, a headless browser, a visitor using a proxy or a crawler tool. Finally, the fingerprint information is processed and a fingerprint ID that can uniquely identify the visitor is generated.

[0050] The specific process is as follows: When a visitor loads a disguised page, the browser fingerprint collection script embedded in the page will automatically run through JavaScript calls to the browser API, first obtaining the basic characteristics of the visitor's device and browser, such as the user agent string (User-Agent), screen resolution, language settings, and time zone offset. This information is extracted through the navigator object and the screen object, and can preliminarily reflect the visitor's browser version, device type, and geographic location. Then, the script calls a lower-level API to further collect hardware and software features, such as using WebGL to extract GPU models, supported extensions, and maximum texture sizes, and generates drawing texture features through the Canvas API to capture the rendering capabilities of the device; in addition, the script calls AudioContext to generate audio spectrum fingerprints, and collects software features such as plug-in lists, font lists, and storage support capabilities, while combining network features such as IP addresses and network types to form a complete multi-dimensional feature set.

[0051] During the consistency check, check whether the GPU rendering capability is consistent with the Canvas drawing result, whether the logical relationship between the language setting and the time zone offset is reasonable, and whether the network environment characteristics match the device capabilities.

[0052] The feature cross-validation mechanism then performs a consistency check on the feature set to capture camouflage behavior. For example, the GPU rendering capability should be consistent with the Canvas drawing result. If the GPU model is detected as a high-performance device (such as NVIDIA GTX1080), but the Canvas drawing result is a simple low-resolution texture, it indicates that camouflage behavior may exist. Similarly, the logical relationship between the language setting and the time zone offset will also be verified. If the language setting is zh-CN (Simplified Chinese) and the time zone is Europe / London, it may indicate that the visitor is using a proxy or VPN. In addition, the system analyzes the matching relationship between network environment characteristics and device capabilities. For example, a significant computing bottleneck is shown under a low-latency, high-speed network connection, which may mean that the device is running in a virtualized environment.

[0053] During standardization, string features are formatted, language and time zone settings are formatted into standard form, list features are sorted alphabetically to generate hash values, numeric features are normalized, and missing features are filled.

[0054] The data is standardized to ensure the consistency and stability of the input data. String features are formatted. For example, irrelevant version numbers and spaces in the user agent string are removed, and only the core information is retained, such as simplifying "Mozilla / 5.0 (Windows NT 10.0; Win64; x64)" to "Win10-x64". The language and time zone settings are also formatted in standard form (such as en-US and UTC+8). For list features, such as plug-in and font lists, the system will sort the data alphabetically and generate hash values ​​to remove the impact of access order on the features; numerical features such as screen resolution and maximum texture size will be normalized, and the values ​​will be mapped to the range of [0,1] to unify the scale to avoid inconsistent dimensions between different features. In addition, the system will fill in the missing features, such as inserting the default placeholder "MissingFonts" when the headless browser lacks a font list to ensure the integrity of the feature set.

[0055] When concatenating into a string and encrypting to generate a unique fingerprint ID, the basic features that have been standardized and consistency checked are concatenated into a string in a fixed order and the concatenated string is encrypted using the SHA-256 hash algorithm to generate a fingerprint ID of a fixed length.

[0056] The flowchart of fingerprint ID generation provided by this method is as follows Figure 2 shown.

[0057] The system concatenates standardized features into a string in a fixed order, such as "GPU-NVIDIA-GTX 4080|CanvasHash-abcdef123|Lang-en-US|TimeZone-America / New_York|Plugins-ab c123|Screen-1920x1080", and encrypts the concatenated string using the SHA-256 hash algorithm to generate a fingerprint ID of a fixed length.

[0058] Define visitor U i The fingerprint ID generation formula is as follows:

[0059] FID i =Hash(S i )

[0060] in:

[0061] FID i Indicates visitor U i Unique fingerprint ID.

[0062] ●S i Is a visitor U i The standardized feature string consists of the following features:

[0063] S i =Concat(G i ,C i ,L i ,T i ,R i ,R i ,···)

[0064] ■G i : GPU characteristics (such as model, maximum texture size).

[0065] ■C i : Canvas drawing hash value.

[0066] ■L i : Language settings.

[0067] ■T i : Time zone offset value.

[0068] ■P i : A hash of the list of plugins and fonts.

[0069] ■R i : Screen resolution.

[0070] ■···: Other information.

[0071] ●Concat is a feature concatenation operation that combines all features into a string in a fixed order, such as:

[0072] S i = "GPU-"G i "|CanvasHash-"C i "|Lang-"L i "|Time-"T i "|Plugins-"P i "|Screen-"R i

[0073] ●Hash uses the SHA-256 algorithm to encrypt the concatenated string.

[0074] This fingerprint ID is unique and stable, and can accurately identify visitors. Even if their IP address changes or their browser is slightly updated, as long as the core features do not change, the generated fingerprint ID will remain consistent.

[0075] When executing S4, during the hazard level assessment, a multi-factor weighted scoring model is used to comprehensively analyze information such as visitor frequency, category labels, and path exploration patterns to generate a dynamic hazard level score.

[0076] By matching the fingerprint ID generated by the visitor with the records in the database, the identity of the returning visitor is accurately identified, and the visitor's danger level is dynamically assessed based on their historical access behavior, attacker category (such as whether there is disguised behavior), and multi-dimensional dynamic analysis indicators, providing accurate guidance for subsequent response strategies. The danger level assessment mechanism introduces a multi-factor scoring model that comprehensively analyzes information such as the visitor's access frequency, category label, and path exploration mode to generate a dynamic danger level score to ensure the comprehensiveness and flexibility of the assessment.

[0077] The specific process is as follows: When a visitor visits the system again, the fingerprint collection script embedded in the disguised page will run and generate the visitor's fingerprint ID. The server quickly matches the fingerprint ID with the records in the database to determine whether it is a returning visitor. If the match is successful, the system will extract the visitor's historical access records, including the paths they have visited, access time, access frequency, and behavior tags, such as "normal user", "using proxy", "headless browser" and other information.

[0078] We define visitor U i The fingerprint ID matching formula is as follows:

[0079] M i=Match(FID i ,DB)

[0080] in:

[0081] ●M i Indicates the matching result. If FID i (Visitor U i The fingerprint ID of M exists in the database. i =1, otherwise M i =0.

[0082] FID i Indicates the fingerprint ID generated by browser characteristics.

[0083] ●DB represents a database storing fingerprint ID and history records.

[0084] ●Match is a database query function used to detect whether the fingerprint ID exists.

[0085] If M i =1, the system will extract the historical record H corresponding to the fingerprint ID i :

[0086] H i = {P i ,T i ,F i ,C i}

[0087] in:

[0088] ●P i : A collection of paths that have been visited.

[0089] ●T i : Access time series.

[0090] ●F i : Visit frequency.

[0091] ●C i : Behavior category label (such as "normal user", "using proxy", "headless browser").

[0092] These historical data are used as basic features to input into the risk level assessment model, which is a multi-factor weighted scoring system that dynamically calculates the visitor's risk score based on the following key indicators:

[0093] 1. Access frequency and path exploration mode: The system will analyze the visitor's access frequency and path sequence to determine whether their behavior is abnormal. For example, multiple visits to different sensitive paths (such as / admin, / phpmyadmin) in a short period of time or rapid path switching usually indicate the intention of blasting or scanning attacks, and the risk level increases significantly; while single path visits with a long interval are considered normal behavior and have a lower risk level.

[0094] 2. Attacker category and disguised behavior: To capture the attacker's disguised behavior, the system will comprehensively determine whether the visitor uses a headless browser, proxy / VPN, or has other disguised behaviors. For example, the basic risk level of an attacker who uses a headless browser or proxy to access will increase, because these behaviors are usually related to automated attack tools; if the visitor is marked as a "normal user", the basic risk level is lower.

[0095] 3. Time dimension analysis: The system will compare the visitor's historical access time with the current access time. For example, if the visitor repeatedly chooses to access sensitive paths late at night or during non-working hours of the system business, it may indicate a planned attack and the risk level will increase.

[0096] 4. Path success rate and response analysis: The system will record the types of dynamic responses triggered after the visitor accesses the disguised path, such as whether the error page is frequently triggered, whether the visitor attempts to submit a form or interact with the page, etc. If it is detected that the visitor's behavior is obviously trying to bypass the disguise mechanism (such as submitting multiple passwords or accessing dynamically generated background pages), the system will regard it as a strong intention to explore the target and increase the risk level.

[0097] Based on these factors, the system will calculate a comprehensive risk score (e.g., a range of 0 to 100) through a scoring model and classify visitors into different risk levels (e.g., "low-risk users" and "high-risk users"). For example, a normal user who only visits a disguised page once and behaves steadily may have a risk score of 10; while a headless browser that uses a proxy and frequently visits multiple sensitive paths may have a risk score of 80 or above.

[0098] The calculated risk score will not only update the visitor's category label in real time, but also trigger the corresponding dynamic response strategy. For example, low-risk users can continue to view the disguised page, while medium- and high-risk users may be prohibited from accessing. All evaluation data will be stored in the database as a basis for subsequent security analysis.

[0099] We define visitor U i The risk score D i The following formula:

[0100] D i =wp ·f p (P i )+w f ·f f (F i )+w c ·f c (C i )+w t ·f t (T i )

[0101] in:

[0102] ●D i Indicates visitor U i The comprehensive risk score.

[0103] ●w p ,w f ,w c ,w t are the weights of path mode, access frequency, behavior category and time dimension, satisfying w p +w f +w c +w t =1.

[0104] ●f p (P i ): Scoring function for path exploration mode, used to evaluate the diversity and sensitivity of access paths. For example, multiple visits to sensitive paths (such as / admin) will significantly increase the score.

[0105] ●f f (F i ): Visit frequency scoring function, the score of visitors with high frequency is increased.

[0106] ●f c (C i ): A behavior category scoring function that is calculated based on the weights of the visitor's category labels. For example, a "headless browser" label might be weighted higher.

[0107] ●f t (T i ): Time dimension scoring function, which analyzes whether the access time is abnormal (for example, late-night access may increase the score).

[0108] Behavior category scoring function f c (C i )The formula is as follows:

[0109]

[0110] in:

[0111] ●C k A label for a category (such as "normal user", "headless browser").

[0112] ●I(C i =C k ) is the indicator function, if C i Belongs to category C k , then I(C i =C k )=1, otherwise it is 0.

[0113] α k is the weight corresponding to the category label (such as "headless browser" has a higher weight).

[0114] According to the visitor's risk score D i , classifying them as low-risk or high-risk users:

[0115]

[0116] in:

[0117] ●L i Indicates visitor U i level of risk.

[0118] ●θ is the threshold of the danger level (for example, the system may set θ=50).

[0119] When storing the evaluation results and the fingerprint ID, the fingerprint ID is annotated and sent to the backend through Ajax technology. The fingerprint ID and the annotation are stored in the fingerprint ID database. If the visitor visits the system again, the fingerprint script will be re-run and generate the same fingerprint ID.

[0120] After the fingerprint ID is generated, the system will combine the results of feature cross-validation to label the visitor as a category, such as "normal user", "headless browser", "using proxy" or "crawler tool". All data is sent to the back-end information collection server through Ajax technology, and the fingerprint ID and category label will be stored in the fingerprint ID database for subsequent matching. If the visitor visits the system again, the fingerprint collection script will be re-run and generate the same fingerprint ID. The system will confirm its identity through database query and identify it as a returning visitor, thereby providing support for dynamic response strategies and further labeling and tracking its behavior.

[0121] The embodiment of the present invention also provides a path honey point system based on browser fingerprint recognition, including:

[0122] Reverse proxy server, used to configure reverse proxy for sensitive paths, proxying access requests and visitor information to dynamic response generation services;

[0123] Dynamic response generation service, used to dynamically generate fake pages based on the number of visits and the risk level, obtain the basic characteristics of the visitor through the fake page, perform consistency checks and standardization to regenerate the fingerprint ID, evaluate the risk level of the visitor, mark the fingerprint ID and store it in the fingerprint information database;

[0124] The fingerprint information base is used to store the visitor's fingerprint ID and annotations, query the visitor's information, and update the annotations according to the danger level assessment results of the dynamic response generation service.

[0125] The reverse proxy server is connected to the dynamic response generation service, and is used to proxy the access request and visitor information to the dynamic response generation service; the dynamic response generation service is connected to the fingerprint database, and is used to store the fingerprint ID and the label in the fingerprint information database, and the fingerprint information database can update the label according to the danger level assessment result of the dynamic response generation service.

[0126] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. A method for identifying path honey points based on browser fingerprint recognition, characterized in that: The following steps are involved: Configure reverse proxy for sensitive paths and obtain visitor IP information; Query the visitor's access times and risk level based on the IP information, and dynamically generate a fake page based on the query results; The basic features of the visitor's device and browser are obtained through the fake page, and after consistency check and standardization of the basic features, they are concatenated into a string and encrypted to generate a unique fingerprint ID; The historical behavior is queried according to the fingerprint ID and the risk level is evaluated, and the evaluation result is stored together with the fingerprint ID.

2. The method for identifying path honey points based on browser fingerprint recognition according to claim 1, characterized in that When the fake page is dynamically generated according to the query result, if it is the first visit, the basic page is returned; if it is the second visit, the updated disguised page is returned; if the sensitive path is frequently visited in a short period of time, the disguised error page is returned.

3. The method for identifying path honey points based on browser fingerprint recognition according to claim 1, characterized in that When obtaining the basic characteristics of the visitor's device and browser, the browser fingerprint script is used to call the relevant browser API using JavaScript to comprehensively collect the visitor's device, browser and network environment information.

4. The method for identifying path honey points based on browser fingerprint recognition according to claim 1, characterized in that During the consistency check, it is checked whether the GPU rendering capability is consistent with the Canvas drawing result, whether the logical relationship between the language setting and the time zone offset is reasonable, and whether the network environment characteristics match the device capabilities.

5. The method for identifying path honey points based on browser fingerprint recognition according to claim 1, characterized in that During the standardization process, string features are formatted, language and time zone settings are formatted into a standard form, list features are sorted alphabetically to generate hash values, numerical features are normalized, and missing features are filled.

6. The method for identifying path honey points based on browser fingerprint recognition according to claim 1, characterized in that When the unique fingerprint ID is generated by splicing into a string and encrypting it, the basic features after standardization and consistency check are spliced ​​into a string in a fixed order and the spliced ​​string is encrypted using the SHA-256 hash algorithm to generate a fingerprint ID of a fixed length.

7. The method for identifying path honey points based on browser fingerprint recognition according to claim 1, characterized in that When evaluating the danger level, a multi-factor weighted scoring model is used to comprehensively analyze information such as visitor's access frequency, category labels, and path exploration patterns to generate a dynamic danger level score.

8. The method for identifying path honey points based on browser fingerprint recognition according to claim 1, characterized in that When the evaluation result and the fingerprint ID are stored, the fingerprint ID is marked and sent to the backend through Ajax technology. The fingerprint ID and the mark are stored in the fingerprint ID database. If the visitor visits the system again, the fingerprint script will be re-run and generate the same fingerprint ID.

9. A system for path honey points based on browser fingerprint recognition, characterized in that: include: Reverse proxy server, used to configure reverse proxy for sensitive paths, proxying access requests and visitor information to dynamic response generation services; Dynamic response generation service, used to dynamically generate fake pages based on the number of visits and the risk level, obtain the basic characteristics of the visitor through the fake page, perform consistency checks and standardization to regenerate the fingerprint ID, evaluate the risk level of the visitor, mark the fingerprint ID and store it in the fingerprint information database; The fingerprint information base is used to store the visitor's fingerprint ID and annotations, query the visitor's information, and update the annotations according to the danger level assessment results of the dynamic response generation service.

10. The system for path honey points based on browser fingerprint recognition according to claim 9, characterized in that The reverse proxy server is connected to the dynamic response generation service, and is used to proxy the access request and visitor information to the dynamic response generation service; the dynamic response generation service is connected to the fingerprint database, and is used to store the fingerprint ID and the label in the fingerprint information database, and the fingerprint information database can update the label according to the danger level assessment result of the dynamic response generation service.

Images