A method and system for path honey pot based on browser fingerprinting

Abstract

The present application relates to the technical field of network security, and particularly relates to a path honeypot method and system based on browser fingerprint identification. The present application provides a path honeypot method and system based on browser fingerprint identification, which focuses on configuring reverse proxy for sensitive paths, judging the behavior of visitors and generating different camouflage page contents, obtaining the device and browser basic characteristics of the visitors for feature cross verification mechanism processing and standardized processing to generate a unique and stable fingerprint ID, performing multi-dimensional dynamic risk level evaluation on the basis of historical behavior to obtain a risk score, labeling and storing the fingerprint ID, matching and identifying the generated fingerprint ID with the stored fingerprint ID when the visitor accesses again, and dynamically responding according to the historical behavior and risk level. The purpose is to save maintenance costs while accurately and effectively resisting attacks and tracing the attacker of the sensitive path.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and system for path honeypot identification based on browser fingerprint recognition. Background Art

[0002] With the rapid development of the internet, web applications have become an integral part of people's daily lives and work. However, with the widespread use of web services, network security threats are also increasing. In particular, attacks against web applications are becoming increasingly complex and diverse. Attackers use scanning and brute-forcing techniques to attempt to detect hidden resources within web services, such as administrative backends, database management systems, or other sensitive functional interfaces. These attacks often rely on access to sensitive URL paths, attempting to discover potential vulnerabilities. Attacks targeting these paths have become a key method of modern network intrusion.

[0003] Path scanning occurs when an attacker uses automated tools to attempt to gain unauthorized access by accessing potentially sensitive paths within a web service. For example, an attacker might attempt to access paths such as / admin, / login, / phpmyadmin, and / config. These paths typically represent administrative interfaces, database management interfaces, or other pages storing sensitive information. If an attacker discovers that these paths are not properly protected, they may further attempt to gain access to the system through brute force or other means.

[0004] Dictionary attack is a common automated attack technique that uses a predefined list of paths to attempt to access a wide range of server paths and then checks the server's response status code. If the server returns a 200 (indicating successful access), the attacker knows the path exists and may proceed with the attack. If the server returns a 404 (indicating the path does not exist), the attacker will continue to try other paths. This method is a highly effective way to test the existence of paths on a web server and quickly identify potential attack points.

[0005] Since these sensitive paths are usually not accessed by normal users, potential attacks can be caught by monitoring access to these paths. Any access to these paths can be considered a probing attack or potential intrusion.

[0006] Browser fingerprinting is a technology that creates a unique identifier by analyzing a visitor's browser and device information. This technology can collect information such as the visitor's browser, plug-ins, operating system, time zone, fonts, screen resolution, etc., and based on this information, generates a unique "fingerprint ID" to identify the visitor's device. Unlike traditional cookie tracking methods, browser fingerprinting does not rely on storing data on the visitor's device. Instead, it collects public information directly from the browser through client-side technologies such as Java Script. Since the combination of parameters such as the characteristics of the browser and its installed plug-ins is almost unique, fingerprinting technology can generate a unique ID through this combined information and track the user without their knowledge.

[0007] Currently, browser fingerprinting technology is widely used in areas such as ad tracking and user behavior analysis. For example, online advertising companies collect browser fingerprints to identify returning visitors and deliver personalized ads based on their browsing habits. In the field of web security, browser fingerprinting technology can be used to identify and track users who visit specific paths.

[0008] Honeypot technology is an active defense mechanism that intentionally deploys fake systems, services, or data to attract attackers and record their behavior. Honeypot systems contain no actual business data and are typically used to trick attackers into accessing and performing operations, thereby helping defenders analyze their behavior, tools, and intentions. Renowned information security expert Lance Spitzner first proposed honeypot technology in 1999 and defined its application in information security.

[0009] With the increase in web attacks in recent years, honeypot technology has been gradually applied to web application security. By deploying fake web services or pages, honeypot technology can capture attackers' scanning and access behaviors on web paths, thereby helping to identify potential attack risks.

[0010] However, most of the existing Web honeypots are limited to simulating common Web services or application environments, making it difficult to accurately capture and analyze path scanning attacks.

[0011] Existing web application firewalls can monitor and filter HTTP requests in real time, preventing path scanning attacks. However, their effectiveness relies heavily on their rule base. Attackers can circumvent web application firewall rule detection by modifying the behavior of scanning tools or developing new path scanning techniques. If the web application firewall's rule base is not updated promptly, it may fail to detect new path scanning methods, resulting in missed detections and ineffective defenses.

[0012] Existing dynamic URL path generation technology dynamically changes the access path to sensitive pages in web applications to prevent attackers from finding sensitive resources through path scanning, dictionary cracking, or other automated tools. Dynamic URL path generation technology generates a unique, temporary URL path for each user or session, preventing the path to sensitive resources from being fixed. However, dynamic URL path generation requires customized development on the server side. Path generation, allocation, session management, and path expiration mechanisms require complex logic to ensure path security and correct access. Managing a large number of dynamic paths is particularly costly in large-scale systems.

[0013] In response to the increasingly severe attacks on Web services and the shortcomings of existing technologies, the present invention proposes a path honey point method based on browser fingerprint recognition, which can accurately and effectively resist attacks and trace attackers while saving maintenance costs. Summary of the Invention

[0014] The purpose of the present invention is to accurately and effectively resist attacks and trace attackers while saving maintenance costs, and to improve the problems of existing technologies such as lack of accuracy and maintenance difficulties.

[0015] In a first aspect, the present invention provides a method for identifying path honeypoints based on browser fingerprinting, comprising the following steps:

[0016] Configure reverse proxy for sensitive paths and obtain visitor IP information;

[0017] Query the visitor's access times and risk level based on the IP information, and dynamically generate a fake page based on the query results;

[0018] The basic characteristics of the visitor's device and browser are obtained through the fake page, and after consistency checking and standardization of the basic characteristics, they are spliced ​​into a string and encrypted to generate a unique fingerprint ID;

[0019] The historical behavior is queried based on the fingerprint ID and a risk level assessment is performed, and the assessment result is stored together with the fingerprint ID.

[0020] The present invention provides a method for identifying path honey points based on browser fingerprint recognition, which has the technical effects of cost saving, accuracy and effectiveness.

[0021] Optionally, when a fake page is dynamically generated as a result of a query, if it is the first visit, the basic page is returned; if it is the second visit, the updated disguised page is returned; if the sensitive path is frequently accessed in a short period of time, a disguised error page is returned.

[0022] Optionally, when obtaining the basic characteristics of the visitor's device and browser, the browser fingerprint script is used to call the relevant browser API using JavaScript to comprehensively collect the visitor's device, browser and network environment information.

[0023] Optionally, during the consistency check, check whether the GPU rendering capability is consistent with the Canvas drawing result, whether the logical relationship between the language setting and the time zone offset is reasonable, and whether the network environment characteristics match the device capabilities.

[0024] Optionally, during standardization, string features are formatted, language and time zone settings are formatted into a standard form, list features are sorted alphabetically and hash values ​​are generated, numeric features are normalized, and missing features are filled.

[0025] Optionally, when splicing into a string and encrypting to generate a unique fingerprint ID, the basic features that have been standardized and consistency checked are spliced ​​into a string in a fixed order and the spliced ​​string is encrypted using the SHA-256 hash algorithm to generate a fingerprint ID of fixed length.

[0026] Optionally, when evaluating the danger level, a multi-factor weighted scoring model is used to comprehensively analyze information such as visitor frequency, category labels, and path exploration patterns to generate a dynamic danger level score.

[0027] Optionally, when storing the evaluation results and the fingerprint ID, the fingerprint ID is marked and then sent to the backend via Ajax technology. The fingerprint ID and the mark are stored in the fingerprint ID database. If the visitor accesses the system again, the fingerprint script will be re-run and generate the same fingerprint ID.

[0028] In a second aspect, the present invention provides a path honeypoint system based on browser fingerprint recognition, comprising:

[0029] Reverse proxy server, used to configure reverse proxy for sensitive paths, proxying access requests and visitor information to dynamic response generation services;

[0030] Dynamic response generation service, used to dynamically generate fake pages based on the number of visits and risk level, obtain basic characteristics of the visitor through the fake page, perform consistency checks and standardization to regenerate a fingerprint ID, assess the visitor's risk level, annotate the fingerprint ID, and store it in the fingerprint information database;

[0031] The fingerprint information database is used to store the visitor's fingerprint ID and label, query the visitor's information, and update the label according to the risk level assessment result of the dynamic response generation service.

[0032] The present invention provides a browser fingerprint identification-based path honey point system with cost-saving, accurate and effective technical effects.

[0033] Optionally, the reverse proxy server is connected to the dynamic response generation service, and is used to proxy the access request and visitor information to the dynamic response generation service; the dynamic response generation service is connected to the fingerprint database, and is used to store the fingerprint ID and label in the fingerprint information database, and the fingerprint information database can update the label according to the danger level assessment result of the dynamic response generation service. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 This is a flow chart of the method for path honey points based on browser fingerprint identification provided by this method;

[0035] Figure 2 This is a flow chart of fingerprint ID generation provided by this method. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meanings understood by people with ordinary skills in the field to which the invention belongs. The words "including" and similar words used in this article mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0037] An embodiment of the present invention provides a method for identifying path honeypoints based on browser fingerprint recognition, comprising the following steps:

[0038] S1. Configure a reverse proxy for sensitive paths and obtain the visitor's IP information;

[0039] S2. Query the visitor's access times and risk level based on the IP information, and dynamically generate a fake page based on the query results;

[0040] S3. Obtain basic characteristics of the visitor's device and browser through the fake page, perform consistency check and standardization on the basic characteristics, concatenate them into a string, and encrypt them to generate a unique fingerprint ID;

[0041] S4. Query the historical behavior according to the fingerprint ID and perform a risk level assessment, and store the assessment result and the fingerprint ID.

[0042] The method flow chart of the path honey point based on browser fingerprint identification provided by this method is as follows Figure 1 shown.

[0043] When executing S1, reverse proxy technology is used instead of traditional redirection technology to guide attackers to the disguised false path page. Because redirection explicitly changes the URL path, attackers can easily identify redirection behavior through URL changes, HTTP status codes, etc., and then realize that there may be a trap mechanism. However, reverse proxy does not change the client-visible URL or status code during the request and response process. Attackers cannot use conventional HTTP tools to detect that the path is being proxied or forwarded, making it difficult for them to detect that the request is being hidden or forwarded.

[0044] The specific process is as follows: This system is deployed on a normally operating Web service A, such as an online service provided by a company, with the access address www.xxx.com. Service A provides normal user access functions to the outside world, but does not disclose certain sensitive paths (such as / admin, / phpmyadmin, etc.). These paths are usually guessed by attackers through dictionary blasting or scanning tools, and a normal user generally does not access these special sensitive paths. Service A does not expose these sensitive paths to the outside world, but configures a reverse proxy for these paths. The role of the reverse proxy is that when it detects a user request to access a non-existent or undisclosed sensitive path (such as / admin), Service A will not return the traditional "404 Not Found" or "403 Forbidden" response, but will capture these requests through NGINX or other proxy servers and proxy them to the dynamic response generation service.

[0045] When executing S2, a fake page is dynamically generated based on the query results. If it is the first visit, the basic page is returned. If it is the second visit, the updated disguised page is returned. If the sensitive path is frequently accessed in a short period of time, a disguised error page is returned.

[0046] The dynamic response strategy makes the disguised page look like a real running system. The dynamic response strategy is that the system will generate different response content for multiple visits to the same path, making it difficult for attackers to determine whether the path is a disguised honeypot by whether the content returned by multiple visits is consistent.

[0047] For example, when it is determined that the attacker is accessing the / admin path for the first time, the dynamic response generation service will return a basic backend management login interface. This page is dynamically generated using a template and contains regular username and password input boxes. When the attacker accesses the path again, the dynamic response generation service will generate an updated disguised page based on the access status. For example, it will add a system status prompt above the login box: "Due to security policy updates, please ensure that your account has two-factor authentication enabled," or display dynamic content such as "During system maintenance, some functions may be unavailable" at the bottom of the page, making the page look more like a real backend system and allowing the attacker to feel the dynamic changes of the page. If the system detects that the attacker frequently accesses the path or attempts multiple sensitive paths in a short period of time, the dynamic response generation service will return a disguised error page such as "503 Service Unavailable" or "System Maintenance" to interfere with the attacker's analysis behavior.

[0048] When executing S3, when obtaining the basic characteristics of the visitor's device and browser, the browser fingerprint script is used to call the relevant browser API using JavaScript to comprehensively collect the visitor's device, browser and network environment information.

[0049] By embedding a browser fingerprint script in a disguised page and using JavaScript to call the browser's relevant API, the visitor's device, browser, and network environment information are comprehensively collected. Combined with the feature cross-verification mechanism, the attacker's disguised behavior is captured to identify whether it is an ordinary user, a headless browser, a visitor using a proxy, or a crawler tool. Finally, the fingerprint information is processed and a fingerprint ID that can uniquely identify the visitor is generated.

[0050] The specific process is as follows: When a visitor loads a disguised page, the browser fingerprint collection script embedded in the page will automatically run through JavaScript calls to the browser API. It first obtains the basic characteristics of the visitor's device and browser, such as the user agent string (User-Agent), screen resolution, language settings, and time zone offset. This information is extracted through the navigator object and the screen object, and can preliminarily reflect the visitor's browser version, device type, and geographic location. Next, the script calls a lower-level API to further collect hardware and software characteristics. For example, it uses WebGL to extract the GPU model, supported extensions, and maximum texture size, while generating drawing texture features through the Canvas API to capture the device's rendering capabilities. In addition, the script calls AudioContext to generate audio spectrum fingerprints and collects software characteristics such as plug-in lists, font lists, and storage support capabilities. At the same time, it combines network characteristics such as IP address and network type to form a complete multi-dimensional feature set.

[0051] During the consistency check, check whether the GPU rendering capabilities are consistent with the Canvas drawing results, whether the logical relationship between the language setting and the time zone offset is reasonable, and whether the network environment characteristics match the device capabilities.

[0052] The feature cross-validation mechanism then performs a consistency check on the feature set to capture camouflage behavior. For example, the GPU rendering capability should be consistent with the Canvas drawing results. If the GPU model is detected as a high-performance device (such as NVIDIA GTX1080), but the Canvas drawing results are displayed as simple low-resolution textures, it indicates that there may be camouflage behavior. Similarly, the logical relationship between the language setting and the time zone offset will also be verified. If the language setting is zh-CN (Simplified Chinese) and the time zone is Europe / London, it may indicate that the visitor is using a proxy or VPN. In addition, the system will analyze the matching relationship between network environment characteristics and device capabilities. For example, if a low-latency, high-speed network connection shows a significant computing bottleneck, this may mean that the device is running in a virtualized environment.

[0053] During standardization, string features are formatted, language and time zone settings are formatted into a standard form, list features are sorted alphabetically and hash values ​​are generated, numeric features are normalized, and missing features are filled in.

[0054] This data is standardized to ensure consistency and stability of the input data. String features are formatted. For example, irrelevant version numbers and spaces in the user agent string are removed, retaining only the core information. For example, "Mozilla / 5.0 (Windows NT 10.0; Win64; x64)" is simplified to "Win10-x64." Language and time zone settings are also formatted to standard forms (e.g., en-US and UTC+8). For list features, such as plugin and font lists, the system alphabetically sorts the data and generates a hash value to remove the influence of access order on the features. Numeric features, such as screen resolution and maximum texture size, are normalized, mapping the values ​​to the range [0, 1] to achieve a uniform scale and avoid dimensional inconsistencies between different features. Furthermore, the system fills in missing features. For example, if a headless browser lacks a font list, a default placeholder "MissingFonts" is inserted to ensure the completeness of the feature set.

[0055] When concatenating and encrypting a string to generate a unique fingerprint ID, the standardized and consistency-checked basic features are concatenated into a string in a fixed order and the concatenated string is encrypted using the SHA-256 hash algorithm to generate a fingerprint ID of a fixed length.

[0056] The flow chart of fingerprint ID generation provided by this method is as follows Figure 2 shown.

[0057] The system concatenates standardized features into a string in a fixed order, such as "GPU-NVIDIA-GTX 4080|CanvasHash-abcdef123|Lang-en-US|TimeZone-America / New_York|Plugins-ab c123|Screen-1920x1080", and encrypts the concatenated string using the SHA-256 hash algorithm to generate a fingerprint ID of fixed length.

[0058] Define visitor U i The fingerprint ID generation formula is as follows:

[0059] FID i =Hash(S i )

[0060] in:

[0061] FID i Indicates visitor U i unique fingerprint ID.

[0062] ●S i is a visitor U i The standardized feature string consists of the following features:

[0063] S i =Concat(G i ,C i ,L i ,T i ,R i ,R i ,···)

[0064] ■G i : GPU characteristics (such as model, maximum texture size).

[0065] ■C i : Canvas drawing hash value.

[0066] ■L i : Language settings.

[0067] ■T i : Time zone offset value.

[0068] ■P i : A hash of the plugin and font lists.

[0069] ■R i : Screen resolution.

[0070] ■···: Other information.

[0071] Concat is a feature concatenation operation that combines all features into a string in a fixed order, such as:

[0072] S i ="GPU-"G i "|CanvasHash-"C i "|Lang-"L i "|Time-"T i "|Plugins-"P i "|Screen-"R i

[0073] ●Hash uses the SHA-256 algorithm to encrypt the concatenated string.

[0074] This fingerprint ID is unique and stable, and can accurately identify visitors. Even if their IP address changes or their browser is slightly updated, as long as the core features do not change, the generated fingerprint ID can remain consistent.

[0075] When executing S4, during the hazard level assessment, a multi-factor weighted scoring model is used to comprehensively analyze information such as visitor frequency, category labels, and path exploration patterns to generate a dynamic hazard level score.

[0076] By matching the visitor's generated fingerprint ID with records in the database, the identity of returning visitors is accurately identified. Combined with their historical access behavior, attacker classification (such as whether there is masquerading), and multi-dimensional dynamic analysis indicators, the visitor's risk level is dynamically assessed, providing precise guidance for subsequent response strategies. The risk level assessment mechanism incorporates a multi-factor scoring model that comprehensively analyzes information such as visit frequency, category tags, and path exploration patterns to generate a dynamic risk level score, ensuring comprehensiveness and flexibility.

[0077] The specific process is as follows: When a visitor accesses the system again, the fingerprint collection script embedded in the disguised page will run and generate the visitor's fingerprint ID. The server quickly matches this fingerprint ID with records in the database to determine whether the visitor is a returning visitor. If a match is successful, the system will extract the visitor's historical access records, including the paths they visited, access time, access frequency, and behavioral tags such as "normal user," "using proxy," and "headless browser."

[0078] We define visitor U i The fingerprint ID matching formula is as follows:

[0079] M i=Match(FID i ,DB)

[0080] in:

[0081] ●M i Indicates the matching result. If FID i (Visitor U i The fingerprint ID) has a record in the database, then M i =1, otherwise M i =0.

[0082] FID i Indicates the fingerprint ID generated by browser characteristics.

[0083] ●DB represents the database that stores fingerprint ID and history records.

[0084] ●Match is a database query function used to detect whether a fingerprint ID exists.

[0085] If M i =1, the system will extract the historical record H corresponding to the fingerprint ID i :

[0086] H i ={P i ,T i ,F i ,C i}

[0087] in:

[0088] ●P i : A collection of visited paths.

[0089] ●T i : Access time series.

[0090] ●F i : Visit frequency.

[0091] ●C i : Behavioral category labels (such as "normal user", "using proxy", "headless browser").

[0092] This historical data is used as basic features to input into the risk level assessment model. The risk level assessment model is a multi-factor weighted scoring system that dynamically calculates the visitor's risk score based on the following key indicators:

[0093] 1. Access frequency and path exploration mode: The system analyzes the visitor's access frequency and path sequence to determine whether their behavior is abnormal. For example, multiple accesses to different sensitive paths (such as / admin, / phpmyadmin) within a short period of time or rapid path switching typically indicate the intent of a brute force or scanning attack, significantly increasing the risk level. However, accesses to a single path at intervals are considered normal behavior and have a lower risk level.

[0094] 2. Attacker Type and Disguise: To identify attackers who are disguising themselves, the system comprehensively determines whether the visitor is using a headless browser, proxy / VPN, or engaging in other disguised behaviors. For example, attackers who access the site using a headless browser or proxy will have their base risk level increased, as these behaviors are often associated with automated attack tools. If a visitor is labeled a "normal user," their base risk level is lower.

[0095] 3. Time Dimension Analysis: The system compares the visitor's historical access time with the current access time. For example, if a visitor repeatedly accesses sensitive paths late at night or during non-operating hours, this may indicate a planned attack and increase the risk level.

[0096] 4. Path Success Rate and Response Analysis: The system records the types of dynamic responses triggered by visitors accessing the disguised path, such as whether they frequently trigger error pages, attempt to submit forms, or interact with the page. If the visitor's behavior is clearly an attempt to circumvent the disguise mechanism (such as submitting multiple passwords or accessing dynamically generated backend pages), the system will consider the intention to explore the target strong and increase the risk level.

[0097] Based on these factors, the system calculates a comprehensive risk score (e.g., a range of 0 to 100) through a scoring model and categorizes visitors into different risk levels (e.g., "low-risk user," "high-risk user"). For example, a normal user who only visits a disguised page once and behaves smoothly might have a risk score of 10; whereas a headless browser that uses a proxy and frequently accesses multiple sensitive paths might have a risk score of 80 or higher.

[0098] The calculated risk score not only updates the visitor's category label in real time but also triggers dynamic response policies. For example, low-risk users can continue to view the disguised page, while medium- and high-risk users may be blocked. All assessment data is stored in a database for subsequent security analysis.

[0099] We define visitor U i The risk score D i is the following formula:

[0100] D i =wp ·f p (P i )+w f ·f f (F i )+w c ·f c (C i )+w t ·f t (T i )

[0101] in:

[0102] ●D i Indicates visitor U i The comprehensive risk score.

[0103] w p ,w f ,w c ,w t are the weights of path mode, access frequency, behavior category and time dimension respectively, satisfying w p +w f +w c +w t =1.

[0104] f p (P i ): Scoring function for path exploration mode, used to evaluate the diversity and sensitivity of access paths. For example, multiple visits to sensitive paths (such as / admin) will significantly increase the score.

[0105] f f (F i ): Visit frequency scoring function, the score of visitors with high frequency is increased.

[0106] f c (C i ): A behavioral category scoring function, calculated based on the weights of the visitor's category labels. For example, the "headless browser" label might be weighted higher in the score.

[0107] f t (T i ): Time dimension scoring function, which analyzes whether the access time is abnormal (for example, late-night access may increase the score).

[0108] Behavior category scoring function f c (C i )The formula is as follows:

[0109]

[0110] in:

[0111] ●C k A category label (such as "normal user", "headless browser").

[0112] ●I(C i =C k ) is the indicator function, if C i Belongs to category C k , then I(C i =C k )=1, otherwise it is 0.

[0113] α k is the weight corresponding to the category label (for example, “headless browser” has a higher weight).

[0114] According to the visitor's risk score D i , classifying them as low-risk or high-risk users:

[0115]

[0116] in:

[0117] ●L i Indicates visitor U i risk level.

[0118] θ is the threshold value of the danger level (for example, the system may set θ=50).

[0119] When the evaluation results are stored with the fingerprint ID, the fingerprint ID is marked and then sent to the backend via Ajax technology. The fingerprint ID and the mark are stored in the fingerprint ID database. If the visitor visits the system again, the fingerprint script will be re-run and generate the same fingerprint ID.

[0120] After the fingerprint ID is generated, the system combines the results of feature cross-validation to label the visitor with a category, such as "normal user," "headless browser," "using a proxy," or "crawler." All data is sent to the backend information collection server via Ajax technology. The fingerprint ID and category label are stored in the fingerprint ID database for subsequent matching. If the visitor accesses the system again, the fingerprint collection script is rerun and generates the same fingerprint ID. The system confirms their identity through a database query and identifies them as a returning visitor, thus supporting dynamic response strategies and further labeling and tracking their behavior.

[0121] An embodiment of the present invention further provides a system for identifying path honey points based on browser fingerprint recognition, comprising:

[0122] Reverse proxy server, used to configure reverse proxy for sensitive paths, proxying access requests and visitor information to dynamic response generation services;

[0123] Dynamic response generation service, used to dynamically generate fake pages based on the number of visits and risk level, obtain basic characteristics of the visitor through the fake page, perform consistency checks and standardization to regenerate a fingerprint ID, assess the visitor's risk level, annotate the fingerprint ID, and store it in the fingerprint information database;

[0124] The fingerprint information database is used to store the visitor's fingerprint ID and label, query the visitor's information, and update the label according to the risk level assessment result of the dynamic response generation service.

[0125] The reverse proxy server is connected to the dynamic response generation service and is used to proxy the access request and visitor information to the dynamic response generation service; the dynamic response generation service is connected to the fingerprint database and is used to store the fingerprint ID and the label in the fingerprint information database, and the fingerprint information database can update the label according to the danger level assessment result of the dynamic response generation service.

[0126] While the embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations of these embodiments are possible. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as set forth in the claims. Furthermore, the invention described herein is susceptible to other embodiments and may be practiced or implemented in a variety of ways.

Claims

1. A method for identifying path honey points based on browser fingerprint recognition, characterized in that: The following steps are involved: Configure reverse proxy for sensitive paths and obtain visitor IP information; The number of visits and risk level of the visitor are queried based on the IP information, and a page is dynamically generated based on the query results, including: returning to the basic page if it is a first visit, returning to an updated disguised page if it is a second visit, and returning to a disguised error page if sensitive paths are frequently accessed within a short period of time; The basic features of the visitor's device and browser are obtained through the disguised page. After consistency checking and standardization, the basic features are spliced ​​into a string and encrypted to generate a unique fingerprint ID. During the consistency check, the consistency between the GPU rendering capability and the Canvas drawing result is checked, the logical relationship between the language setting and the time zone offset is reasonable, and the network environment features match the device capabilities. During the standardization process, the string features are formatted, the language and time zone settings are formatted into a standard form, the list features are sorted alphabetically to generate a hash value, the numerical features are normalized, and missing features are filled in. The historical behavior of the visitor is queried based on the fingerprint ID and the risk level is evaluated. When the evaluation result and the fingerprint ID are stored, the following steps are included: the fingerprint ID is marked and then sent to the back end through Ajax technology, and the fingerprint ID and the mark are stored in the fingerprint ID database. If the visitor visits the system again, the fingerprint script will be re-run and the same fingerprint ID will be generated; when the visitor visits the system again, the fingerprint collection script embedded in the disguised page will be run and generate the fingerprint ID of the visitor. The server quickly matches the fingerprint ID with the records in the database to determine whether the visitor is a returning visitor. If the match is successful, the system will extract the visitor's historical visit records, including the paths they have visited, the time of visit, the frequency of visit and the behavior tags.

2. The method for identifying path honey points based on browser fingerprint recognition according to claim 1, characterized in that When obtaining the basic characteristics of the visitor's device and browser, the browser fingerprint script is used to call the relevant API of the browser using JavaScript to comprehensively collect the visitor's device, browser and network environment information.

3. The method for identifying path honey points based on browser fingerprint recognition according to claim 1, characterized in that When the above-mentioned string is spliced ​​and encrypted to generate a unique fingerprint ID, the basic features after standardization and consistency check are spliced ​​into a string in a fixed order and the spliced ​​string is encrypted using the SHA-256 hash algorithm to generate a fingerprint ID of fixed length.

4. The method for identifying path honey points based on browser fingerprint recognition according to claim 1, characterized in that When evaluating the danger level, a multi-factor weighted scoring model is used to comprehensively analyze information such as the visitor's visit frequency, category label, and path exploration pattern to generate a dynamic danger level score.

5. A system for path honeypoints based on browser fingerprint identification, used to implement the method of claim 1, characterized in that: include: Reverse proxy server, used to configure reverse proxy for sensitive paths, proxying access requests and visitor information to dynamic response generation services; Dynamic response generation service, used to dynamically generate fake pages based on the number of visits and risk level, obtain basic characteristics of the visitor through the fake page, perform consistency checks and standardization to regenerate a fingerprint ID, assess the visitor's risk level, annotate the fingerprint ID, and store it in the fingerprint information database; The fingerprint information database is used to store the visitor's fingerprint ID and label, query the visitor's information, and update the label according to the risk level assessment result of the dynamic response generation service.

6. The browser fingerprint recognition-based path honeypoint system according to claim 5, characterized in that The reverse proxy server is connected to the dynamic response generation service and is used to proxy the access request and visitor information to the dynamic response generation service; the dynamic response generation service is connected to the fingerprint database and is used to store the fingerprint ID and the label in the fingerprint information database, and the fingerprint information database can update the label according to the danger level assessment result of the dynamic response generation service.

Images