A network attack tracing method, system, device and medium based on user portrait

Abstract

This application relates to a network attack tracing method, system, device and medium based on user portraits. The attack tracing method includes: collecting user interaction behavior data on web pages; compressing and serializing the interaction behavior data to generate a structured interaction log file; collecting user terminal fingerprint data and performing standardization processing to generate a fingerprint feature vector; generating a user unique identifier containing a risk level label based on the structured interaction log file and the fingerprint feature vector; clustering the interaction behavior data based on the user unique identifier to identify abnormal user behavior patterns and mark the attack type; obtaining the public IP address of the abnormal user and locating the geographic location in combination with the IP database; and constructing an attack tracing report based on the abnormal user's user unique identifier, abnormal behavior pattern, public IP address and geographic location. This application can accurately construct user portraits and effectively identify and trace network attack behaviors.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network attack tracing method, system, device and medium based on user portrait. Background Art

[0002] In today's enterprise web business scenarios, with the increasing complexity of user needs and the evolving network environment, traditional user information collection and profiling technologies face increasing challenges. To enhance user experience and strengthen network security, many companies are using a variety of technologies to collect user data and build user profiles. These technologies often involve multiple data sources such as cookies, local storage, server logs, JavaScript tracking code, API call records, and user purchase history. By analyzing this data, companies can gain a deeper understanding of user interests, preferences, and personal information, and use this information to distinguish real users from automated attackers (such as crawlers and malicious scripts).

[0003] However, as cyberattack methods continue to evolve, traditional technologies are gradually revealing their limitations. First, these technologies struggle to effectively adapt to the demanding demands of modern network environments. Especially when faced with large amounts of complex data, traditional methods lack the ability to capture and parse it, making it difficult to accurately distinguish between real users and attackers. Second, because most traditional data collection methods rely on static data sources (such as IP addresses and browser cookies), they are unable to accurately identify the source of attacks when attackers use concealment methods such as proxies, VPNs, and dynamic IP addresses, resulting in a relatively weak defense. Furthermore, traditional user profile construction methods suffer from limited data dimensions, making it difficult to comprehensively consider multiple complex factors, such as users' dynamic behavior and device characteristics. This significantly reduces the accuracy and practicality of the profiles.

[0004] Therefore, how to accurately build user portraits based on the efficient collection of user behavior data, effectively identify and trace network attack behaviors, and improve the security and defense capabilities of Web services is an urgent problem that needs to be solved. Summary of the Invention

[0005] In order to improve the efficiency and accuracy of network security protection, the present application provides a network attack tracing method, system, device and medium based on user portrait.

[0006] In the first aspect, the present application provides a method for tracing the source of network attacks based on user profiling, which adopts the following technical solutions:

[0007] A network attack tracing method based on user profiling, the attack tracing method comprising:

[0008] Collect user interaction behavior data on web pages; the interaction behavior data includes DOM node change records, mouse track coordinates, page scrolling position, input content and timestamp;

[0009] Compressing and serializing the interaction behavior data to generate a structured interaction log file;

[0010] Collect user terminal fingerprint data through the browser environment interface; the user terminal fingerprint data includes device model, screen resolution, GPU rendering characteristics, IP address, time zone information and WebGL fingerprint;

[0011] Standardizing the user terminal fingerprint data to generate a fingerprint feature vector;

[0012] Based on the structured interaction log file and the fingerprint feature vector, a user unique identifier including a risk level label is generated by a dynamic hash algorithm;

[0013] Performing cluster analysis on the interaction behavior data according to the user unique identifier to identify abnormal behavior patterns of abnormal users and mark the attack type;

[0014] Obtain the public IP address of the abnormal user and locate the geographic location based on the IP database;

[0015] An attack tracing report is constructed based on the user unique identifier, abnormal behavior pattern, public IP address and geographic location of the abnormal user.

[0016] By employing the aforementioned technical solutions, combined with user behavior data, terminal fingerprint information, and a dynamic hashing algorithm, a comprehensive and accurate user profile is constructed, which can then be used to effectively identify and trace network attacks. By collecting user interactions on web pages, standardizing terminal fingerprint data, generating unique identifiers, and analyzing abnormal behavior using multiple data sources, various potential attack types, such as scraping, credential stuffing, and DDoS attacks, can be detected in real time. Furthermore, by leveraging technologies such as WebRTC to break through traditional IP protection measures, the attacker's real IP address and geographic location can be accurately located, generating detailed attack tracing reports. This significantly enhances network security protection capabilities, provides effective attack warning and tracing methods, and improves the response speed and accuracy of the defense system.

[0017] Optionally, the step of generating a user unique identifier including a risk level label by a dynamic hash algorithm based on the structured interaction log file and the fingerprint feature vector includes:

[0018] Collecting a time series of interactive behavior data in the structured interactive log file; the time series includes operation intervals and behavioral pattern characteristics;

[0019] Based on a pre-configured weight coefficient matrix, a high weight value is assigned to the unconventional operation according to the characteristics of the behavior pattern, and the operation interval time is weighted and summed to calculate the behavior consistency score;

[0020] Collect hardware features from user terminal fingerprint data; the hardware features include device model, screen resolution, and GPU rendering parameters;

[0021] Hash the hardware features and calculate the device stability score based on the matching degree between the hash value and the preset trusted device library;

[0022] Based on the behavior consistency score and the device stability score, a risk level score is generated through a linear combination formula, and a corresponding risk level label is determined;

[0023] The hashed hardware feature and the risk level tag are encoded to obtain a unique user identifier.

[0024] By employing this technical solution, users' interactive behavior data and device fingerprints are comprehensively collected, and a unique user identifier (UID) containing a risk level tag is generated using a dynamic hashing algorithm. By combining behavioral consistency scores with device stability scores, the system can accurately distinguish between legitimate users and potential attackers, improving defenses against complex network attacks such as scraping, credential stuffing, and DDoS attacks. This technical solution not only enhances the system's ability to identify abnormal behavior and trace attack sources, but also provides accurate risk assessment and attack detection while protecting user privacy, significantly improving the security and protection capabilities of web applications.

[0025] Optionally, the step of performing cluster analysis on the interactive behavior data according to the user unique identifier, identifying abnormal behavior patterns of abnormal users, and marking attack types includes:

[0026] Grouping the interaction behavior data according to the user unique identifier, and extracting the operation path sequence, time series features, and interaction intensity features from the interaction behavior data;

[0027] Perform sliding window segmentation on the time series features and calculate the click frequency and scrolling speed within the window;

[0028] Performing operation path word segmentation processing on the operation path sequence to generate operation path segments;

[0029] Normalizing the click frequency, scrolling speed, operation path segment, and interaction intensity features to obtain user behavior characteristics;

[0030] Inputting the user's behavior characteristics into a clustering algorithm to generate a user behavior clustering result;

[0031] Based on the user behavior clustering results, calculating the Mahalanobis distance between the user's behavior characteristics and the cluster center, and marking users whose Mahalanobis distance exceeds a preset abnormality threshold as abnormal users;

[0032] Performing pattern analysis on the behavioral characteristics of the abnormal user to identify abnormal behavior patterns;

[0033] The behavioral characteristics and abnormal behavior patterns of the abnormal user are input into a pre-trained classification model to obtain an attack type label.

[0034] By employing these technical solutions, we can accurately identify abnormal user behavior patterns and label them as attack types. By leveraging multi-dimensional user behavior data and employing advanced unsupervised and supervised learning methods, we comprehensively enhance our ability to detect and defend against network attacks. Furthermore, through real-time monitoring and dynamic updates, we can flexibly respond to complex and ever-changing attack patterns, providing efficient and accurate technical support for network security protection.

[0035] Optionally, the step of performing pattern analysis on the behavioral characteristics of the abnormal user to identify the abnormal behavior pattern includes:

[0036] Based on the user behavior clustering results, a user behavior benchmark template is constructed; wherein the user behavior benchmark template includes a regular operation path segment library, a time series feature mean and a standard deviation;

[0037] Calculating the difference between the abnormal user's behavior characteristics and the user behavior benchmark template, including path difference, click frequency deviation, and scrolling speed deviation;

[0038] Compare the difference with the preset difference threshold and mark the abnormal behavior label;

[0039] Perform weighted fusion based on the difference to generate a comprehensive anomaly score and determine a comprehensive anomaly level;

[0040] The abnormal behavior pattern is obtained by combining the abnormal behavior label and the comprehensive abnormality level.

[0041] By employing this technical solution, we accurately identify and label abnormal behaviors based on differential analysis of user behavior clustering results. This is combined with weighted fusion calculations to generate a comprehensive anomaly score. By comprehensively analyzing the comprehensive anomaly level of abnormal users and labeling abnormal labels such as high-frequency clicks and unconventional paths, we provide a straightforward and effective means of attack identification and tracing for network security protection. The system can flexibly respond to different types of attack behaviors, improving the accuracy and response speed of abnormal behavior detection and enhancing network protection capabilities.

[0042] Optionally, after building the attack source tracing report, the following steps may also be performed:

[0043] Performing threat intelligence correlation on the attack source tracing report based on a preset threat intelligence database to obtain a threat intelligence correlation result;

[0044] Calculate an attack risk score based on the threat intelligence correlation results;

[0045] Generate a disposal priority list based on the attack risk score, and call a preset strategy library to match the response strategy;

[0046] Based on the priority list and response strategy, execute the policy instructions through the security orchestration platform and record the policy execution status and result log;

[0047] Monitor changes in attack indicators after policy execution, evaluate policy effectiveness, and update the preset threat intelligence library and preset policy library.

[0048] By implementing this technical solution, we automatically generate a prioritized list of actions and execute corresponding response strategies based on detailed data from attack tracing reports, combined with threat intelligence correlation and risk scoring. Through the security orchestration platform, policies are rapidly executed and their status recorded. The system also monitors changes in attack indicators, assesses policy effectiveness, and dynamically updates the threat intelligence and policy libraries. This technical solution ensures efficient response to cyberattacks, improves defense intelligence and responsiveness, and, through continuous optimization and updates, enhances protection against complex attack scenarios.

[0049] Optionally, the attack source tracing method further includes:

[0050] Obtaining social networking site data associated with the abnormal user; wherein the social networking site data includes public metadata and social graph data;

[0051] Performing sensitive information filtering and correlation analysis on the social networking site data to generate a social behavior feature vector;

[0052] Fusion of the social behavior feature vector with the fingerprint feature vector and interaction behavior data to generate a multi-dimensional user portrait;

[0053] Based on the multi-dimensional user portrait, the risk attributes of the multi-dimensional user portrait are integrated into the attack tracing report to form an enhanced attack tracing report;

[0054] According to the enhanced attack tracing report, the matching logic of the response strategy in the preset strategy library is dynamically adjusted.

[0055] By adopting the above technical solutions, the intelligent level of attack identification and defense has been significantly improved based on the integration of multi-source data and dynamic policy adjustment. By obtaining data from social networking sites, the system can reveal the attacker's social behavior background and attack propagation path; through multi-dimensional user portrait generation, the system can comprehensively assess the user's potential risks; through enhanced attack tracing reports, the system provides security personnel with more detailed attack context, helping to quickly locate key nodes; finally, based on this data and reports, the system can dynamically adjust protection strategies to improve defense accuracy and response speed. While improving attack tracing capabilities, this solution also reduces the false blocking rate, improves the personalization and adaptability of protection strategies, and provides a powerful response to complex network attacks.

[0056] Optionally, the step of filtering sensitive information and performing correlation analysis on the social networking site data to generate a social behavior feature vector includes:

[0057] Hash-encrypting the user identification information in the social networking site data, deleting the original user identifier in the social relationship chain, and performing regional aggregation on the geographic location information to obtain filtered social networking site data;

[0058] Build a social graph based on filtered social networking site data, apply graph algorithms to identify key nodes and risk-related paths, and obtain graph algorithm analysis results;

[0059] Perform time series correlation analysis on filtered social networking site data, aligning social behavior timestamps with abnormal login event times, and counting high-risk behaviors within a specified time window after the abnormal login event to obtain time correlation analysis results;

[0060] Based on the graph algorithm analysis results and the time correlation analysis results, a social behavior feature vector is generated.

[0061] By employing these technical solutions, we generate user social behavior feature vectors from multiple dimensions (including social graphs, time series, and behavioral characteristics), enabling accurate identification of potential attacks. Through encryption of sensitive information and regional aggregation, we ensure user privacy while preserving key social behavior characteristics. Combining graph algorithms with temporal correlation analysis, the system extracts high-value security information from users' social interactions and behavioral patterns, providing solid data support for attack identification and protection strategies.

[0062] Secondly, this application provides a network attack tracing system based on user portraits, which adopts the following technical solutions:

[0063] A network attack tracing system based on user portraits, the attack tracing system comprising:

[0064] The interactive behavior collection module is used to collect user interactive behavior data on Web pages; the interactive behavior data includes DOM node change records, mouse track coordinates, page scrolling position, input content and timestamp;

[0065] A data processing module, configured to compress and serialize the interaction behavior data to generate a structured interaction log file;

[0066] Fingerprint data collection module, used to collect user terminal fingerprint data through the browser environment interface; the user terminal fingerprint data includes device model, screen resolution, GPU rendering characteristics, IP address, time zone information and WebGL fingerprint;

[0067] A standardization processing module, configured to perform standardization processing on the user terminal fingerprint data to generate a fingerprint feature vector;

[0068] An identifier generation module, configured to generate a user unique identifier including a risk level label by a dynamic hash algorithm based on the structured interaction log file and the fingerprint feature vector;

[0069] A cluster analysis module, configured to perform cluster analysis on the interaction behavior data according to the user unique identifier, identify abnormal behavior patterns of abnormal users and mark attack types;

[0070] A positioning module is used to obtain the public IP address of the abnormal user and locate the geographical location in combination with the IP database;

[0071] The attack tracing module is used to build an attack tracing report based on the user unique identifier, abnormal behavior pattern, public IP address and geographical location of the abnormal user.

[0072] In a third aspect, the present application provides a computer device that adopts the following technical solution:

[0073] A computer device comprises a memory, a processor and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the method according to the first aspect.

[0074] In a fourth aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution:

[0075] A computer-readable storage medium stores a computer program capable of being loaded by a processor and executing any one of the methods in the first aspect.

[0076] In summary, the present application includes at least one of the following beneficial technical effects: comprehensive collection of user interaction behavior data, user terminal fingerprint data and dynamically generated user unique identifiers to build an accurate network attack tracing system. The present application can record user operation behavior more efficiently, generate small-sized, lossless and more detailed user action playback, better track the user's specific operation path, identify abnormal behavior, and perform effective cluster analysis on user data through dynamic hashing algorithms, accurately identify automated attacks and real users, and then automatically merge attack behaviors from the same attack source. At the same time, the WebRTC method is used to break through the protection of proxies and VPNs, obtain real public IP addresses, and help locate the attacker's detailed network information. Ultimately, by combining this information to generate an attack tracing report, not only the accuracy and efficiency of attack detection and analysis are improved, but also data support can be provided for the optimization of defense strategies. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] Figure 1 This is a first flow chart of a network attack tracing method based on user portraits in one of the embodiments of the present application.

[0078] Figure 2 This is a second flow chart of a network attack tracing method based on user portraits in one of the embodiments of the present application.

[0079] Figure 3 This is the third flow chart of a network attack tracing method based on user portraits in one of the embodiments of the present application.

[0080] Figure 4 This is the fourth flow chart of a network attack tracing method based on user portraits in one of the embodiments of the present application.

[0081] Figure 5 This is the fifth flow chart of a network attack tracing method based on user portraits in one of the embodiments of the present application.

[0082] Figure 6 This is the sixth flow chart of a network attack tracing method based on user portraits in one of the embodiments of the present application.

[0083] Figure 7 This is the seventh flow chart of a network attack tracing method based on user portraits in one of the embodiments of the present application. DETAILED DESCRIPTION

[0084] In order to make the purpose, technical solutions and advantages of this application more clear, the following Figure 1-7It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application.

[0085] An embodiment of the present application discloses a network attack tracing method based on user profiling.

[0086] Reference Figure 1 A network attack tracing method based on user portraits, the attack tracing method includes:

[0087] Step S101, collecting user interaction behavior data on a web page;

[0088] Among them, the interactive behavior data includes DOM node change records, mouse track coordinates, page scroll position, input content and timestamp;

[0089] It's understandable that user interactions on web pages not only reflect browsing preferences but can also reveal potential security risks. Web page interaction data collection involves recording all user interactions with the page using front-end scripting tools. These actions include, but are not limited to, mouse clicks, mouse movement patterns, page scrolling positions, keyboard input, and interactions with other DOM elements. These actions help the system build a dynamic profile based on real-world user behavior.

[0090] Specifically, you can integrate the rrweb.js library into your website. The rrweb.js library is a front-end interactive behavior capture tool that seamlessly integrates into web pages. By monitoring DOM changes, mouse events, input content, page scrolling, and other aspects, it captures all user actions on the page in real time. Each action record is timestamped and tied to the user's operation path, forming a traceable action chain. To ensure efficient data transmission and storage, the collected interaction data is compressed and serialized, typically in JSON format. This not only effectively reduces data volume but also ensures a clear data structure for subsequent analysis.

[0091] It's important to note that the importance of this interactive behavior data lies in its ability to provide key clues for subsequent behavioral analysis. For example, if a user repeatedly visits multiple sensitive pages and performs frequent click operations, this behavior may be flagged as potential attack behavior. Therefore, the collection of interactive behavior data lays the foundation for further user profiling and attack tracing.

[0092] Step S102: compressing and serializing the interaction behavior data to generate a structured interaction log file;

[0093] Among them, by converting the original behavioral data into a data format that is easy to store, transmit and structured, a large amount of data can be transmitted over the network and stored in the database without causing excessive performance pressure.

[0094] Specifically, data compression involves using algorithms to reduce redundant data, thereby reducing storage space and network transmission bandwidth requirements. Common compression methods include text-based data compression algorithms, such as JSON format compression. This compression method significantly reduces data size while preserving data integrity. Serialization refers to the process of converting objects into a specific format, typically using JSON to express these interactive behavior data. JSON allows different types of data (such as strings, numbers, arrays, Boolean values, etc.) to be encapsulated in a unified structure, making it easier to parse and process them.

[0095] For example, after capturing a user clicking a button, the system packages this interaction and its associated metadata (such as timestamp, button ID, click location, etc.) into a log data entry. After compression and serialization, this data can be efficiently stored and transmitted to the backend. Ultimately, the processed structured interaction logs form a data file with a standardized format, facilitating aggregated analysis of user behavior.

[0096] Step S103, collecting user terminal fingerprint data through the browser environment interface;

[0097] Among them, user terminal fingerprint data includes device model, screen resolution, GPU rendering characteristics, IP address, time zone information and WebGL fingerprint;

[0098] It's understandable that terminal fingerprint data uniquely identifies a user's device, encompassing multi-dimensional information at the hardware, software, and network levels. The purpose of collecting terminal fingerprint data is to uniquely identify users by identifying device characteristics and to maintain device uniqueness across sessions. Compared to traditional IP-based identity verification methods, terminal fingerprint data can effectively identify users even when they frequently switch networks or use proxies.

[0099] Specifically, terminal fingerprint data is primarily collected through browser environment interfaces. Commonly collected information includes device model, operating system version, screen resolution, GPU rendering characteristics (extracted via WebGL), IP address, time zone information, and WebGL fingerprint. This information forms a unique "fingerprint" for the user's device, which is far more unique and stable than a simple IP address or cookie. Through JavaScript's navigator interface, the WebGL API, and WebRTC technology, the system can obtain this information without directly requesting the user's private data.

[0100] For example, WebGL fingerprints are generated by capturing the browser's hardware rendering characteristics. These characteristics are based on the browser's graphics rendering context, including but not limited to the GPU model, WebGL version, and anti-aliasing support. These characteristics provide high uniqueness, as GPU rendering capabilities vary significantly across devices. By collecting this fingerprint data, the system can construct a highly reliable and stable user identity and effectively distinguish the behavioral characteristics of different users within the same network environment.

[0101] Step S104, normalizing the user terminal fingerprint data to generate a fingerprint feature vector;

[0102] Because the collected terminal fingerprint data is highly diverse and often contains inconsistent formats for device characteristics, network environment information, and other data, it is necessary to standardize this data. The standardization process involves converting and encrypting different types of data to ensure that all collected data can be compared and used under the same standards.

[0103] In this step, standardization not only refers to the uniformity of formats but also includes the handling of sensitive data. For example, IP addresses and device IDs may contain sensitive information. To protect user privacy, this data needs to be hashed. Hash encryption technology converts raw data into an irreversible encrypted value through a specific algorithm, ensuring that the original data cannot be restored and preventing the leakage of user privacy.

[0104] Ultimately, the standardized data generates a fingerprint feature vector. This feature vector is an array consisting of multiple dimensions, each representing a specific attribute of the terminal device (such as device model, screen resolution, GPU features, etc.). This feature vector uniquely identifies a device and is stable, remaining valid even after the device is restarted or the user logs back in. By unifying data from different formats and sources into a comparable feature vector, subsequent user analysis, cluster analysis, and attack identification can all be performed under the same standard.

[0105] Step S105: Based on the structured interaction log file and the fingerprint feature vector, a user unique identifier including a risk level label is generated by a dynamic hash algorithm;

[0106] Generating a unique user identifier (UID) based on user behavior and device fingerprint data is crucial for subsequent analysis. Combining user behavior and device fingerprint data creates a comprehensive user profile. Using a dynamic hashing algorithm, this behavioral data and device fingerprint characteristics are mapped to a unique identifier. This identifier is not only unique but also categorizes the user's behavior based on risk, assigning a risk level label.

[0107] Specifically, a dynamic hashing algorithm weights the time series in the interaction log and the user's behavioral patterns to generate a behavioral consistency score. A device stability score is then generated based on the hardware characteristics in the device fingerprint data. Ultimately, these scores are linearly combined to form a user identification number (UID). The UID incorporates user behavioral characteristics, device stability, and potential risk information, thus uniquely identifying the user and reflecting their risk level.

[0108] For example, if a user has a high behavioral consistency score and a low device stability score, the system might label that user as "high risk." Conversely, if a user has low behavioral consistency and high device stability, the system might label that user as "low risk." This method of generating UIDs based on both behavioral and device characteristics can help the system more accurately identify and flag potential attackers or abnormal users.

[0109] Step S106, performing cluster analysis on the interactive behavior data based on the user unique identifier, identifying abnormal behavior patterns of abnormal users and marking the attack type;

[0110] Cluster analysis is an unsupervised learning method that analyzes user behavior patterns to identify different types of behavior. Based on the generated UID, the system can use clustering algorithms to group users with similar behaviors together, thereby identifying abnormal behavior patterns. Abnormal behavior patterns typically manifest as interaction patterns that differ significantly from typical user behavior. For example, a user's frequent access to sensitive information or unusual login attempts within a short period of time may be flagged as potential attack behavior.

[0111] Specifically, during behavioral analysis, the system extracts features such as user operation paths, click frequency, and scrolling speed. It then uses machine learning models (such as XGBoost) to classify this data and output attack types. For example, a user's frequent login failures and high-frequency API calls within a short period of time might be classified as a "credential stuffing attack." If a user's behavior deviates significantly from normal behavior, the system will flag them as a potential attacker.

[0112] Step S107: Obtain the public IP address of the abnormal user and locate the geographical location by combining it with the IP database;

[0113] Understandably, while users may hide their real IP addresses through proxies or VPNs, technologies like WebRTC allow the system to effectively penetrate these protections and obtain the user's true public IP address. Combined with an IP database, the system can locate the user's geographic location, providing additional evidence for attack tracing.

[0114] Specifically, WebRTC is a technology that can directly obtain a user's real IP address. While it's typically used in real-time communication scenarios, it can also be used to bypass traditional proxy detection, obtaining the user's real, unencrypted IP address. This, combined with an IP database, can pinpoint the attacker's actual location. This technology allows the system to detect and track attackers hiding behind proxies.

[0115] It should be noted that in some embodiments, user geolocation information may involve private data and therefore may require sensitive information filtering and encryption. To ensure compliance with privacy regulations (such as GDPR), this data can be hashed and aggregated by region, for example, retaining only provincial administrative divisions to prevent the disclosure of user personal information while preserving key attack signatures.

[0116] Step S108: construct an attack tracing report based on the unique user identifier, abnormal behavior pattern, public IP address, and geographic location of the abnormal user.

[0117] Attack tracing reports are a crucial tool for network security defense. By combining unique user identifiers, abnormal behavior patterns, public IP addresses, and geographic locations, the system can accurately construct an attacker's attack path and identity. Attack tracing reports not only include the attacker's identity but also reveal the attack's source, path, and potential purpose.

[0118] For example, if an attacker launches a DDoS attack through an automated script, the system will generate a complete attack tracing report based on the attacker's IP address, device characteristics, behavior patterns, etc., indicating the attack path and related accounts.

[0119] In the above implementation, a comprehensive and accurate user profile is constructed by combining user behavior data, terminal fingerprint information, and a dynamic hash algorithm. Based on this profile, network attack behaviors can be effectively identified and traced. By collecting user interaction behaviors on web pages, standardizing terminal fingerprint data, generating unique identifiers, and combining multiple data sources for abnormal behavior analysis, various potential attack types such as crawlers, database stuffing attacks, and DDoS attacks can be detected in real time. At the same time, by using technologies such as WebRTC to break through traditional IP protection methods, the attacker's real IP and geographic location can be accurately located, and detailed attack tracing reports can be generated. This greatly enhances network security protection capabilities, provides effective attack warning and tracing methods, and improves the response speed and accuracy of the defense system.

[0120] Reference Figure 2 As an implementation of step S105, the step of generating a user unique identifier including a risk level label using a dynamic hash algorithm based on the structured interaction log file and the fingerprint feature vector includes:

[0121] Step S201, collecting the time series of interaction behavior data in the structured interaction log file;

[0122] Among them, the time series includes operation intervals and behavior pattern characteristics;

[0123] It's understandable that during user interaction with a web page, the interval between each operation and the characteristics of each operation (i.e., behavioral patterns) both reflect the user's behavioral habits. Interaction intervals represent the time difference between different user interactions, while behavioral pattern characteristics include click frequency, operation path, scrolling speed, input rhythm, and more. These behavioral pattern characteristics help the system analyze user operation patterns and assess whether there are irregular or abnormal behavioral patterns.

[0124] Specifically, by analyzing interaction log files, the system extracts the time intervals between each user action and related behavioral pattern features. For example, if a user clicks multiple buttons on a page, the system will record the timestamps of each click and the time interval between them. Additionally, behavioral pattern features may include the text entered by the user or the speed of a scroll bar.

[0125] For example, when a user visits a website, he quickly clicks on multiple links with a very short time interval between each click. This may be an unusual operation mode. The system will record these behavioral characteristics as the basis for subsequent analysis.

[0126] Step S202: Based on a pre-configured weight coefficient matrix, assign high weight values to unconventional operations according to behavioral pattern characteristics, perform weighted summation on the operation intervals, and calculate a behavioral consistency score;

[0127] To accurately assess whether user behavior is normal, the system weights each action based on its "routineness." Unusual actions typically refer to those that are inconsistent with typical user behavior, such as frequent clicks, rapid page switching, or excessively repetitive input. By assigning higher weights to these unconventional actions, the impact of these abnormal behaviors in the overall behavior score can be highlighted.

[0128] Specifically, a weight coefficient matrix can be defined based on behavioral pattern characteristics, assigning different weights to each behavioral characteristic. For example, if a user's click speed is unusually fast, a higher weight can be assigned to this action. The system then calculates a behavioral consistency score through weighted summation. The behavioral consistency score reflects the degree to which the user's actions conform to normal behavioral patterns; a higher score indicates more consistent behavior.

[0129] For example, if a user quickly clicks multiple buttons, with each click occurring within less than a second, the system will label this action as "unconventional" and assign it a higher weight based on a predefined weighting matrix. Ultimately, the system calculates the user's behavior consistency score through weighted summation. A low score may indicate that the user's behavior is potentially risky.

[0130] Step S203: collecting hardware features from the user terminal fingerprint data; wherein the hardware features include device model, screen resolution, and GPU rendering parameters;

[0131] It's understandable that the characteristics of a user's terminal device are an important basis for identifying their identity. Hardware features, such as device model, screen resolution, and GPU rendering parameters, are typically inherent to the device, relatively stable, and highly unique. By collecting these hardware features, the system can effectively distinguish between different users, especially when using obfuscation methods like proxies or VPNs, where hardware features can still provide strong support for user identity.

[0132] Specifically, through the interfaces provided by the browser (such as the navigator object and the WebGL API), the system can collect information such as the device model, screen resolution, and GPU rendering characteristics. For example, GPU rendering parameters can be extracted through the WebGL interface. These parameters are based on the device's graphics hardware and can provide a highly unique identifier.

[0133] For example, suppose a user is using a MacBook Pro with a resolution of 2880x1800 and its GPU rendering characteristics show a specific model of AMD graphics card. Through these hardware characteristics, the system can uniquely identify the user's device.

[0134] Step S204: Hash the hardware features and calculate the device stability score based on the matching degree between the hash value and the preset trusted device library;

[0135] To protect user privacy and ensure secure device identification, hardware feature data is hashed. This process converts hardware features into irreversible encrypted values, preventing the leakage of the device's true information. Furthermore, the hash value is matched against a pre-defined trusted device database to calculate a device stability score. The device stability score reflects the consistency of the device across sessions, and users with higher device stability are considered more trustworthy.

[0136] Specifically, a hash algorithm (such as SHA-256) can be used to encrypt the device's hardware characteristics (such as device model, screen resolution, and GPU rendering parameters). The system then compares the encrypted hash value with a preset trusted device library. If a high match is found, the device is considered trusted, resulting in a higher device stability score.

[0137] For example, if a user uses a MacBook Pro to access a website, the system hashes the device's hardware characteristics (such as model and GPU) to generate an encrypted value. This encrypted value is then compared with the value in the device library. If a high match is achieved, the device's stability score is higher.

[0138] Step S205: Based on the behavior consistency score and the device stability score, a risk level score is generated through a linear combination formula, and a corresponding risk level label is determined;

[0139] Specifically, the behavior consistency score and the device stability score are combined through a linear combination to generate a risk level score. In the linear combination formula, the weights (α and β) of the behavior consistency score and the device stability score are adjusted according to actual conditions to ensure a balance between the two.

[0140] In some embodiments, the linear combination formula is:

[0141] RiskScore=α·(1-Score_behavior)+β·(1-Score_hardware);

[0142] In the above formula, α and β are preset weight parameters, Score_behavior is the behavior consistency score, Score_hardware is the device stability score, and RiskScore is the risk level score.

[0143] As an implementation method of the risk level label, if the risk level score RiskScore ≥ high risk threshold, the corresponding risk level label is "high risk"; if the risk level score RiskScore < high risk threshold and ≥ medium risk threshold, the corresponding risk level label is "medium risk"; if the risk level score RiskScore < medium risk threshold, the corresponding risk level label is "low risk".

[0144] Step S206: Encode the hashed hardware features and the risk level tag to obtain a unique user identifier.

[0145] Among them, the user's unique identifier (UID) can be generated through Base64 encoding. The encoded content contains hashed hardware characteristics and risk level labels, which can not only uniquely identify the user, but also reflect the user's risk level.

[0146] It can be understood that the calculated risk level score (RiskScore) is combined with the user's behavior and device characteristics to ultimately generate a UID to reflect the user's behavior and device stability, and to mark the corresponding risk level label.

[0147] In this implementation, user interaction data and device fingerprints are collected, and a unique user identifier (UID) containing a risk level tag is generated using a dynamic hashing algorithm. By combining behavioral consistency scores with device stability scores, the system can accurately distinguish between legitimate users and potential attackers, improving defenses against complex network attacks such as scraping, credential stuffing, and DDoS attacks. This technical solution not only enhances the system's ability to identify abnormal behavior and trace attack sources, but also provides accurate risk assessment and attack detection while protecting user privacy, significantly improving the security and protection capabilities of web applications.

[0148] Reference Figure 3 As an implementation of step S106, the steps of performing cluster analysis on the interactive behavior data according to the user unique identifier, identifying abnormal behavior patterns of abnormal users and marking the attack types include:

[0149] Step S301: Grouping the interactive behavior data according to the user unique identifier, extracting the operation path sequence, time series features, and interaction intensity features in the interactive behavior data;

[0150] The user's unique identifier (UID) is a key element in identifying the user. Grouping interaction behavior data based on the UID allows the same user's behavior data from multiple sessions to be aggregated. The core goal of this step is to extract features such as the user's operation path, time interval, and interaction intensity. These features provide an important basis for subsequent behavioral pattern recognition.

[0151] Specifically, interaction log files are grouped by UID to ensure that all behavioral data for the same user is aggregated. This data includes, but is not limited to, the order in which users click on a page (operation path sequence), the time interval between each operation (time series characteristics), and interaction intensity characteristics (number of clicks, scrolling distance, and number of characters entered per unit time).

[0152] For example, suppose user A performs the following operations in sequence in a session: "Login → Personal Center → Payment Page". The system will record this path as the operation path sequence; if the user stays on the "Payment Page" for 30 seconds and clicks twice, then the time series feature of this operation is the "30 seconds" stay time, and the interaction intensity features are "number of clicks = 2" and "scroll distance = 200px".

[0153] Step S302: Segment the time series features into sliding windows and calculate the click frequency and scrolling speed within the window;

[0154] The sliding window method is an effective technique for processing time series data, particularly suitable for dynamically changing behavioral data. By defining the window size and step size, behavioral data can be segmented and analyzed, calculating click frequency and scrolling speed within the window. These dynamic features can help the system detect behavioral anomalies, such as unusually frequent clicks or excessively fast scrolling speeds.

[0155] Specifically, the system defines sliding window parameters such as window size (e.g., 5 seconds) and step size (e.g., 1 second), and then segments the time series data. For each window, the system calculates the click frequency (i.e., the number of clicks within the window divided by the window duration) and the scrolling speed (i.e., the scrolling distance within the window divided by the window duration).

[0156] For example, if a user clicks 3 times within 5 seconds and the page scrolls 500px within those 5 seconds, the system calculates the click frequency to be 3 / 5 = 0.6 clicks / second and the scrolling speed to be 500 / 5 = 100px / second. These calculation results can serve as a basis for further analysis.

[0157] Step S303, performing operation path segmentation processing on the operation path sequence to generate operation path segments;

[0158] Among them, operation path segmentation is a method of breaking down the user's continuous operation sequence on the page into small segments. It can effectively analyze the user's behavior trajectory and identify whether there are abnormal operation sequences or abnormal jump patterns.

[0159] Specifically, the user's operation path on the page is segmented using n-grams, breaking down the continuous operation path into several operation segments. For example, "Login → Payment → Logout" can be split into "Login → Payment" and "Payment → Logout." This allows the system to capture the details of user operations more precisely, providing information for subsequent clustering and anomaly detection.

[0160] For example, assuming the user's operation path is: "Login → Personal Center → Payment Page → Payment Successful", after word segmentation, the system can break it down into operation path fragments such as "Login to Personal Center", "Personal Center Payment Page", "Payment Successful on Payment Page", etc. These fragments can help the system identify whether the operation process meets expectations.

[0161] Step S304: normalize the click frequency, scrolling speed, operation path segment, and interaction intensity features to obtain user behavior characteristics;

[0162] The purpose of normalization is to convert features of different dimensions into a unified standard, ensuring that all features are compared and analyzed at the same scale. Z-score normalization is a commonly used normalization method that converts feature data into a distribution with a mean of 0 and a standard deviation of 1, thereby preventing dimensional differences between features from adversely affecting clustering and classification results.

[0163] Specifically, the Z-score normalization process is performed on each user's behavioral characteristics, and the formula is: Where X is the raw data, μ is the mean, and σ is the standard deviation. In this way, all behavioral features (such as click frequency, scrolling speed, etc.) are standardized so that they can be compared on the same scale.

[0164] For example, assuming a user's click frequency is 0.8 times per second and their scrolling speed is 100px per second, after normalization, the click frequency and scrolling speed values will be converted into Z-score values, eliminating the impact of their dimensions.

[0165] Step S305: Input the user's behavior characteristics into a clustering algorithm to generate a user behavior clustering result;

[0166] Cluster analysis is an unsupervised learning method used to group users based on similarities in their behavior. Through cluster analysis, the system can group users with similar behavioral characteristics together, thereby identifying common and abnormal behaviors.

[0167] Specifically, standardized user behavior features are fed into a clustering algorithm to group user behaviors. The DBSCAN clustering algorithm can automatically identify low-density, abnormal clusters, while K-means requires a preset number of clusters and relies on optimizing cluster centers to group users.

[0168] For example, if the system uses DBSCAN to cluster user behavior, the system may classify normal users into a high-density cluster and users who click frequently into a low-density cluster. The low-density cluster may represent potential attackers or abnormal users.

[0169] Step S306: Based on the user behavior clustering results, the Mahalanobis distance between the user's behavior characteristics and the cluster center is calculated, and users whose Mahalanobis distance exceeds a preset abnormal threshold are marked as abnormal users;

[0170] The Mahalanobis distance is a method for measuring the similarity between user behavior characteristics and cluster centers, taking into account the correlation between characteristics. Based on the clustering results of behavioral characteristics, the Mahalanobis distance between each user's behavior characteristics and the cluster center is calculated to determine whether the user's behavior falls within the normal range. Users exceeding the preset abnormality threshold are marked as abnormal users, while those within the preset abnormality threshold are considered normal users.

[0171] Specifically, the Mahalanobis distance formula is used to calculate the distance between each user and its cluster center: ;

[0172] In the above formula, X is the user behavior feature, C is the cluster center, and S is the covariance matrix of the feature. In this embodiment of the application, if the Mahalanobis distance exceeds a preset abnormal threshold (such as 3 times the standard deviation), the user is marked as an abnormal user.

[0173] Step S307: Analyze the behavior characteristics of abnormal users and identify abnormal behavior patterns;

[0174] Among them, through further analysis of the characteristics of abnormal user behavior, the differences between it and other normal user behaviors are extracted, and these differences are converted into specific abnormal behavior patterns.

[0175] Step S308: Input the behavioral characteristics and abnormal behavior patterns of the abnormal user into the pre-trained classification model to obtain an attack type label.

[0176] Abnormal user behavior characteristics (such as click frequency, scrolling speed, and differences in operation paths) are fed into a pre-trained classification model. The classification model can use the XGBoost model, an ensemble learning algorithm that can learn the characteristics of different attack types from training data.

[0177] In one embodiment of the present application, the XGBoost-based attack type classification model adopts a gradient boosted tree (GBDT) ensemble learning architecture, which mainly consists of four modules: data input and feature processing, gradient boosted tree ensemble, model training and tuning, and prediction and confidence output. At the data processing layer, the model processes multi-dimensional user behavior features through one-hot encoding and Z-score normalization, and optimizes input data through feature screening. The gradient boosted tree optimizes classification error through residual learning, using a logarithmic loss function and regularization terms (L1 and L2) to prevent overfitting. Model training uses cross-validation and grid search to adjust hyperparameters, and evaluates feature contributions through feature importance. In the prediction stage, the model outputs confidence based on Softmax and supports incremental training to deal with new attacks. The model achieves accurate attack classification, strong generalization ability, and high robustness through nonlinear modeling, regularization, and dynamic update mechanisms.

[0178] Specifically, the model can predict a user's attack type label based on input features, such as "credential stuffing attack," "crawler behavior," or "DDoS simulation." Furthermore, the model outputs a confidence score for the attack type, indicating the model's confidence in the prediction. For example, suppose user A exhibits an abnormal behavior pattern of "high frequency clicks + unconventional paths." The system inputs this user's behavioral characteristics and abnormal behavior pattern into the XGBoost model, and the model outputs a "credential stuffing attack" label with an 80% confidence score.

[0179] The above implementation accurately identifies abnormal user behavior patterns and labels them as attack types. By leveraging multi-dimensional user behavior data and employing advanced unsupervised and supervised learning methods, the system comprehensively enhances its ability to detect and defend against network attacks. Furthermore, through real-time monitoring and dynamic updates, it can flexibly respond to complex and ever-changing attack patterns, providing efficient and accurate technical support for network security protection.

[0180] Reference Figure 4 As an implementation of step S307, the steps of performing pattern analysis on the behavioral characteristics of abnormal users and identifying abnormal behavior patterns include:

[0181] Step S401: constructing a user behavior benchmark template based on the user behavior clustering result;

[0182] Among them, the user behavior benchmark template includes a library of regular operation path fragments, time series feature mean and standard deviation;

[0183] Specifically, the system first performs cluster analysis on a large number of user behaviors to extract the behavioral patterns of regular users. This baseline template represents the typical behavioral characteristics of regular users and serves as a reference for comparison with abnormal user behavior. This template consists of two core components: a library of regular operation path fragments and the mean and standard deviation of time series features (such as click frequency and scrolling speed).

[0184] Specifically, by analyzing clustering results, the system extracts and constructs common operation path segments. Each common operation path segment represents the user's operation sequence in a specific scenario, reflecting the common pattern of user behavior. Furthermore, the system statistically analyzes the behavioral data of common users to calculate the mean and standard deviation of time series characteristics. For example, statistics such as click frequency (number of clicks per unit time), page dwell time, and scrolling speed are used to determine their mean and standard deviation for subsequent behavioral deviation analysis.

[0185] For example, let's assume the system finds that "Login → Personal Center → Payment Page" is a typical path for most users. The system records this as a regular operation path segment. When counting click frequencies, the system finds that most normal users click 5 times per minute, with a standard deviation of 1 click. This data is then used as part of the baseline template.

[0186] Step S402, calculating the difference between the abnormal user's behavior characteristics and the user behavior benchmark template, including path difference, click frequency deviation, and scrolling speed deviation;

[0187] The core of abnormal behavior identification is calculating the degree of difference between the behavioral characteristics of an abnormal user and a baseline template of normal behavior. The greater the difference, the more abnormal the user's behavior, and the more likely they are to engage in aggressive behavior. This step assesses the degree of abnormality by comparing the abnormal user's operation path, click frequency, and scrolling speed with the baseline template of normal user behavior.

[0188] Specifically, by using an edit distance algorithm (such as the Levenshtein distance) to calculate the minimum matching distance between the abnormal user's operation path and a library of regular path fragments, we obtain the path difference degree, which reflects the degree to which the user's behavior differs from the regular path. By calculating the degree of deviation between the abnormal user's click frequency and the mean of regular users in the baseline template, we obtain the click frequency deviation degree, which assesses whether the user frequently performs abnormal click operations. The calculation formula is: click frequency deviation degree = |abnormal value − regular mean | / regular standard deviation. Similarly, the scrolling speed deviation degree is calculated by calculating the deviation of the abnormal user's scrolling speed from the mean and standard deviation of regular users.

[0189] For example, suppose an abnormal user frequently changes paths and performs a large number of clicks after logging in. Their click frequency reaches 20 times per minute, far higher than the 5 times of a regular user. The system calculates the deviation of this user's click frequency. If the deviation is 3, this indicates that this user's click behavior is significantly higher than that of a normal user.

[0190] Step S403: Compare the difference with the preset difference threshold and mark the abnormal behavior label;

[0191] Specifically, by comparing the operation paths of abnormal users with those of normal users, the path difference is calculated. If the path difference of the abnormal user exceeds a preset difference threshold, it can be marked as abnormal behavior. At the same time, the click frequency and scrolling speed of the abnormal user per unit time are calculated and compared with the average of normal users. If the deviation of the abnormal user's click frequency and scrolling speed exceeds the preset difference threshold, it can also be marked as abnormal behavior. By analyzing the above features, specific abnormal behavior labels are identified, such as "high frequency clicks + unconventional path", which indicates that the user frequently clicks and jumps to unusual pages in a short period of time.

[0192] For example, suppose a user frequently switches pages after logging in, with an abnormally high click frequency and an unconventional page jump path (e.g., jumping directly from the "login page" to the "payment page"). By comparing the operation paths and click behaviors of other normal users, the system can identify this user's abnormal behavior as "high frequency clicks + unconventional path."

[0193] Step S404: Perform weighted fusion based on the difference to generate a comprehensive anomaly score and determine the comprehensive anomaly level;

[0194] Weighted fusion of differences comprehensively considers the differences of multiple features to generate a comprehensive anomaly score. By assigning weights to different differences (such as path difference and click frequency deviation), the system can prioritize certain features based on actual circumstances. A higher comprehensive anomaly score indicates more abnormal user behavior and a higher likelihood of attack.

[0195] In some embodiments, a comprehensive anomaly score can be calculated by weighted fusion, that is, weights are assigned to the path difference, click frequency deviation, and scrolling speed deviation respectively, and a final score is obtained by combining them: comprehensive anomaly score = w1⋅path difference + w2⋅click frequency deviation + w3⋅scrolling speed deviation; among which w1, w2, and w3 are preset weight parameters, indicating the contribution of different features to the anomaly score.

[0196] Furthermore, the comprehensive abnormality score is compared with the preset score threshold to determine the comprehensive abnormality level; for example, if the comprehensive abnormality score is ≥0.8, it indicates the presence of a "high-risk abnormality"; if 0.5≤comprehensive abnormality score<0.8, it indicates the presence of a "medium-risk abnormality"; if the comprehensive abnormality score is <0.5, it indicates the presence of a "low-risk abnormality".

[0197] Step S405 : combining the abnormal behavior label and the comprehensive abnormality level to obtain the abnormal behavior pattern.

[0198] For example, if user A's overall anomaly score is 0.85 and their label is "High-frequency clicks + Unconventional paths," the system will output the abnormal behavior pattern as "High-risk anomaly: Unconventional paths + High-frequency clicks." If the score is 0.75, the system will output "Medium-risk anomaly: Unconventional paths + High-frequency clicks." If the score is 0.4, the system will output "Low-risk anomaly: Unconventional paths + High-frequency clicks."

[0199] In this implementation, based on differential analysis of user behavior clustering results, anomalous behavior is accurately identified and labeled. A weighted fusion calculation is then used to generate a comprehensive anomaly score. By comprehensively analyzing the comprehensive anomaly level of abnormal users and labeling abnormal labels such as high-frequency clicks and unconventional paths, this provides an intuitive and effective means of attack identification and tracing for network security protection. The system can flexibly respond to different types of attack behaviors, improving the accuracy and response speed of abnormal behavior detection and enhancing network protection capabilities.

[0200] Reference Figure 5 As a further implementation of the network attack source tracing method, after the step of constructing the attack source tracing report, the method further includes:

[0201] Step S501: performing threat intelligence correlation on the attack source tracing report based on a preset threat intelligence database to obtain a threat intelligence correlation result;

[0202] The attack tracing report contains basic attacker information, such as the anomalous user's unique identifier, unusual behavior patterns, public IP address, and geographic location. This information provides preliminary data support for attack analysis. By correlating this information with a pre-built threat intelligence library, we can further deepen our understanding of the attacker. The threat intelligence library typically contains historical attack records and malicious IP blacklists. These data sources help identify threat intelligence correlation results, such as the attacker's infrastructure, attack sources, and historical attack activity.

[0203] Specifically, the data in the attack tracing report is matched with the preset threat intelligence library, and the internal threat intelligence library (such as the historical attack IP blacklist) and the external threat intelligence API (such as the malicious IP scoring interface) are called to associate the attacker's identity, behavior and infrastructure, generating a more comprehensive threat intelligence association result. The association result includes key information such as the C2 (Command and Control) server IP used by the attacker and the different stages of the attack chain (such as the data theft stage).

[0204] For example, assuming that the IP address in the tracing report matches the historical attack IP blacklist, the system will mark the IP as a malicious source and infer that the attacker may be in the data theft stage.

[0205] Step S502: Calculate the attack risk score based on the threat intelligence correlation result;

[0206] By correlating threat intelligence results, the system can comprehensively assess the potential risk of an attack. When calculating the attack risk score, multiple factors are considered, including the attack's impact range, attack frequency, and historical success probability. Attacks with high risk scores are prioritized to prevent further damage.

[0207] Specifically, the risk score is calculated based on a pre-defined formula that combines multiple influencing factors: the attack impact range (the number of users affected by the attack and the extent of the damage); the attack frequency (the frequency of attacks, with frequent attacks generally indicating a greater threat); and the historical success probability (the proportion of successful attacks in the attacker's history). Each factor is weighted according to its impact on the attack, ultimately generating a comprehensive attack risk score.

[0208] Step S503: Generate a disposal priority list based on the attack risk score, and call the preset strategy library to match the response strategy;

[0209] Once the attack risk score is calculated, the system prioritizes the attacks based on the score and uses a predefined policy library to respond accordingly. Different attack types (such as credential stuffing, crawler behavior, and DDoS simulation) may require different response strategies.

[0210] Specifically, the system generates a prioritized list of actions based on the attack risk score. High-risk attacks are placed at the top of the list and immediately matched with pre-defined response strategies. The policy library includes specific measures for different attack types, such as blocking malicious IP addresses for credential stuffing attacks, implementing dynamic verification codes for crawling attacks, and performing traffic scrubbing for DDoS simulations.

[0211] For example, if the risk score of an attack is 0.85 (high risk) and it is identified as a credential stuffing attack, the system will automatically select the "Block IP" policy and prioritize it.

[0212] Step S504: Based on the disposal priority list and the response strategy, the security orchestration platform executes the policy instructions and records the policy execution status and result log;

[0213] The security orchestration platform serves as the command center for policy execution, ensuring smooth policy execution and recording execution status and results in real time to facilitate subsequent audits and improvements. It automatically executes policy instructions generated from the priority list. These instructions include the policy ID, target IP address, execution action (such as blocking or limiting), and effective duration. After each policy execution, the platform logs the execution status and results, including information such as whether the execution was successful, the execution time, and the execution results.

[0214] For example, assuming that a ban policy is executed on a certain IP, the platform will record the execution status of the banned IP, including the time of the ban, the banned IP address and the execution result.

[0215] Step S505: monitor the attack indicator changes after the policy is executed, evaluate the effectiveness of the policy, and update the preset threat intelligence library and the preset policy library.

[0216] Monitoring the effectiveness of policy execution is a crucial step in evaluating its effectiveness. The system evaluates policy effectiveness based on changes in attack metrics (such as attack frequency and traffic volume). If a policy is ineffective, the system rolls it back and generates an alternative policy, ensuring continuous improvement of defense mechanisms.

[0217] Specifically, after a policy is executed, the system continuously monitors changes in relevant attack indicators (such as attack traffic and malicious IP behavior) to assess the policy's effectiveness. If attack indicators decrease and remain at a low level for a predetermined period after policy execution, the policy is considered effective. Conversely, if attack indicators are not effectively controlled, the policy is considered ineffective. Based on the effectiveness of the policy, the system adjusts the threat intelligence and policy libraries to optimize the response strategy.

[0218] For example, assuming that after the IP blocking policy is executed, the monitoring data shows that the attack traffic is significantly reduced, the policy is evaluated as effective; if the attack traffic is not reduced, the policy rollback is triggered and a new policy is generated for trial.

[0219] In this implementation, based on the detailed data from attack tracing reports, combined with threat intelligence correlation and risk scoring, a prioritized list of actions is automatically generated and corresponding response strategies are executed. Through the security orchestration platform, policies are rapidly executed and their status recorded. The system also monitors changes in attack indicators, assesses policy effectiveness, and dynamically updates the threat intelligence and policy libraries. This technical solution ensures efficient response to cyberattacks, improves defense intelligence and responsiveness, and, through continuous optimization and updates, enhances protection against complex attack scenarios.

[0220] Reference Figure 6 As a further implementation method of the network attack source tracing method, the attack source tracing method further includes:

[0221] Step S601, obtaining social networking site data associated with abnormal users;

[0222] The main sources of social networking site data include public metadata and social graph data. Public metadata generally includes users' public posts, likes, and comment history, while social graph data primarily includes information such as friendships, group memberships, and interaction frequency. This data can provide a multi-dimensional perspective for subsequent analysis, helping to reveal potential attacks.

[0223] Specifically, to obtain this data, the system typically calls the open APIs provided by social platforms. Many platforms offer specific APIs that allow external applications to access users' public information through identity authentication. For example, some platforms' APIs provide a user's friend list, like history, and posted content, while others can access a user's tweets and interaction history. Through these APIs, the system can extract users' social behavior data, identify potential attacks, and provide support for tracing and analysis.

[0224] It's important to note that for some social platforms, data scraping may not be possible directly through a browser or client due to same-origin policies or API call restrictions. In these cases, the system can bypass the same-origin policy restrictions through server-side proxy technology, using the server to simulate browser behavior to scrape users' publicly available social data. This approach allows users' social graph data to be collected without violating the platform's privacy policy, further enriching the analysis of attacker behavior.

[0225] It's understandable that by analyzing this social networking data, the system can identify frequent user interactions with malicious accounts, phishing websites, and malicious links, thereby revealing possible connections to attack behavior. For example, an attacker might use social engineering to leverage the influence of a well-known account to spread malicious links. This social interaction data can reveal the attacker's social dissemination path, providing important clues for subsequent analysis.

[0226] Step S602: Filter sensitive information and conduct correlation analysis on the social networking site data to generate a social behavior feature vector;

[0227] Data from social networking sites contains a large amount of user behavior information, some of which may involve sensitive private information such as nicknames and friend relationships. When processing this data, sensitive information must be filtered and encrypted to ensure that the data meets privacy protection requirements, especially under the premise of complying with international privacy regulations (such as GDPR).

[0228] Specifically, sensitive information filtering can be performed by hashing a user's sensitive information using an encryption algorithm (such as SHA-256). This ensures that even if the data is leaked, the hash value cannot be used to recover the user's real information. This approach ensures that the user's privacy is protected while still being able to leverage the topological structure of social data for attack tracing and analysis.

[0229] Furthermore, correlation analysis of social data itself is crucial, especially when user behavior poses a potential attack risk. Behavioral data on social networking sites typically exhibits a complex graph structure, where each node in the social relationship represents a user, and each edge represents the interaction between them. Within this graph structure, the system can apply graph algorithms (such as PageRank and Dijkstra) to identify key nodes. By analyzing the social behavior of these key nodes, users with strong correlations to anomalous behavior can be effectively identified. For example, if a user forwards content containing a phishing link within one hour after a failed login attempt, the system can identify this behavior as a potential threat through correlation analysis, inferring that the user may have been attacked or that an attacker is spreading malicious activity on the social platform.

[0230] Furthermore, correlation analysis isn't limited to social relationships; it can also incorporate time series analysis to conduct multi-dimensional analysis. For example, when detecting unusual user login behavior, the system can analyze the user's social behavior after the failed login to determine whether they forwarded malicious links or participated in other unusual activities. If there's a significant temporal match between these social behaviors and the attack event, the system can further determine that the user presents a higher risk.

[0231] For example, the user nickname "Zhang San" is encrypted with SHA-256 hash to obtain the encrypted value "abcd1234"; then through time series analysis, it is found that user A forwarded the phishing email link within 1 hour after the login failure.

[0232] Step S603: Fusing the social behavior feature vector with the fingerprint feature vector and the interaction behavior data to generate a multi-dimensional user portrait;

[0233] User profiling not only includes social behavior traits but also incorporates device fingerprints and interaction data to comprehensively assess potential risks. In cybersecurity, user profiling has become a crucial tool for identifying attackers. By integrating multi-dimensional features, the system can more accurately identify user risks and adjust protection strategies accordingly.

[0234] Specifically, social behavior feature vectors typically include social interaction information related to the attacker, such as the frequency of linking to phishing website accounts and interactions with malicious accounts. Fingerprint feature vectors, on the other hand, identify device information to determine whether a user is at risk of malicious behavior. For example, attackers may use virtual machines or anonymous networks to hide their true identities. These device fingerprint features can provide a more accurate risk assessment for user profiles. Interaction behavior data includes various behavioral data generated by users while using a system or application. If a user normally follows a specific operation path, they may deviate from this path during an attack. This behavioral difference can serve as a key basis for identifying attacks. By analyzing this behavioral data, the system can further determine whether there is any abnormal behavior and, by combining social and device fingerprint features, generate a comprehensive user profile.

[0235] For example, the multi-dimensional user profile field is {Device Type: PC, Social Relationship Risk: High, Operation Path Deviation: 0.8}. The weight distribution rule is: Device Type (0.3) + Social Relationship (0.4) + Operation Path (0.3).

[0236] Step S604: Based on the multi-dimensional user profile, the risk attributes of the multi-dimensional user profile are integrated into the attack source tracing report to form an enhanced attack source tracing report;

[0237] The purpose of generating enhanced attack tracing reports is to combine multi-dimensional user profile information with attack tracing data to provide more detailed and accurate attacker information. This enhanced report not only includes the attacker's basic behavioral patterns, but also includes information related to the attacker's social background, device fingerprints, social behavior characteristics, and other information. This can provide security teams with more comprehensive context and help them quickly locate key nodes in the attack chain.

[0238] For example, the original attack tracing report is: Abnormal user UID: A123, behavior pattern: high-frequency clicks. The enhanced attack tracing report is: UID: A123, behavior pattern: high-frequency clicks, risk attribute: virtual machine device + associated phishing account. The enhanced report further provides risk attributes of the attacker, such as the use of virtual machines and association with known phishing accounts.

[0239] Understandably, in tracing reports, attacker behavior is often presented through IP addresses, login times, and unusual behavior patterns, but this data doesn't fully reflect the attacker's background. By incorporating risk attributes from user profiles into the report, the system can provide additional context, such as whether the attacker used virtual machines or had frequent social interactions with phishing websites or malicious accounts. This information can help security personnel better understand the attacker's motivations and further infer their identity and attack path.

[0240] Step S605: Dynamically adjust the matching logic of the response strategies in the preset strategy library according to the enhanced attack source tracing report.

[0241] Among them, based on the risk attributes in the enhanced attack tracing report, the system can adjust the matching rules in the policy library in real time, thereby improving the accuracy and adaptability of the protection strategy.

[0242] Specifically, the system dynamically adjusts its policy library based on the attacker's risk profile (e.g., whether they use virtual machines or frequently click on malicious links). For example, for high-risk users, the system can automatically enable stricter verification mechanisms, such as secondary verification and behavioral sandboxing. For low-risk users, the system can streamline the verification process to improve the user experience. This dynamic adjustment mechanism effectively reduces false positives and improves the targeted and flexible nature of protection policies.

[0243] For example, the original response strategy is: "High frequency clicks" corresponds to "Block IP". The response strategy after dynamic adjustment is: "High frequency clicks + virtual machine devices" corresponds to "Enable behavioral sandbox isolation".

[0244] In the above implementation, the intelligent level of attack identification and defense is significantly improved based on the fusion of multi-source data and dynamic policy adjustment. By obtaining data from social networking sites, the system can reveal the attacker's social behavior background and attack propagation path; through multi-dimensional user portrait generation, the system can comprehensively assess the user's potential risks; through enhanced attack tracing reports, the system provides security personnel with more detailed attack context to help quickly locate key nodes; finally, based on these data and reports, the system can dynamically adjust protection strategies to improve defense accuracy and response speed. While improving attack tracing capabilities, this solution also reduces the false blocking rate, improves the personalization and adaptability of protection strategies, and provides a powerful response to complex network attacks.

[0245] Reference Figure 7 As an implementation of step S602, the steps of filtering sensitive information and performing correlation analysis on social networking site data to generate a social behavior feature vector include:

[0246] Step S701: Hash the user identification information in the social networking site data, delete the original user identifier in the social relationship chain, and perform regional aggregation on the geographical location information to obtain filtered social networking site data;

[0247] Understandably, when collecting data from social networking sites, users' personal information (such as nicknames, email addresses, and so on) and geographic location information may involve private data, necessitating sensitive information filtering and encryption. To ensure compliance with privacy regulations (such as GDPR), this data undergoes hashing and regional aggregation to prevent the leakage of users' personal information while preserving key attack signatures.

[0248] Specifically, an irreversible hash algorithm (such as SHA-256) can be used to encrypt user identifiers (such as nicknames, email addresses, etc.). The hash algorithm can convert the user's original identifier into a hash value of fixed length, thereby preventing the leakage of sensitive information. Since the hash operation is irreversible, even if the data is leaked, the original information cannot be restored from the hash value. In addition, to avoid exposing the true identity of the user, the original user identifier (such as the user ID) in the social relationship chain will be deleted, and only the relationship topology will be retained. This means that the connection of the social relationship still exists, but it cannot be directly traced back to a specific user. In addition, in order to maintain the validity of the geographic information without leaking the precise geographic location, the user's geographic location information is regionally aggregated, for example, only provincial administrative division information is retained. In this way, the system can obtain the user's approximate location while avoiding the leakage of the precise location.

[0249] Step S702: constructing a social graph based on the filtered social networking site data, applying a graph algorithm to identify key nodes and risk association paths, and obtaining a graph algorithm analysis result;

[0250] The purpose of building a social graph is to model user relationships on social platforms and analyze key nodes and potential risk association paths within social networks using graph algorithms. These key nodes and risk association paths can reveal users' social influence, potential attacker connections, and possible attack propagation paths.

[0251] Specifically, a social graph is a graph structure consisting of nodes (representing users) and edges (representing social relationships between users). When constructing the graph, the system generates edges between nodes based on the social relationship chains (such as friendships and group affiliations) in filtered social data. Each edge can represent a different type of social relationship (such as friendships and group memberships). By applying graph algorithms (such as PageRank and Dijkstra's algorithm), the system can identify key nodes (e.g., users with significant social influence) and risky association paths between users within the social graph.

[0252] In some embodiments, the PageRank algorithm can be used to calculate the importance of each node and identify influential users who may be potential attack sources or targets. The Dijkstra algorithm can be used to calculate the shortest path between nodes to assess the risk association between users and known attackers.

[0253] Step S703: Perform time series correlation analysis on the filtered social networking site data, align the timestamps of social behavior with the time of abnormal login events, and count high-risk behaviors within a specified time window after the abnormal login event to obtain time correlation analysis results;

[0254] The core purpose of time series analysis is to align social behaviors with unusual login events and analyze the patterns of social behavior following unusual events. Aligning the timestamps of social behaviors with unusual login events can help identify potential attacks or signs of social engineering. By analyzing behavior within a specific time window after an unusual event, the attacker's likely trajectory can be identified, providing more accurate early warnings for defense systems.

[0255] Specifically, the timestamps in social data are aligned with the times of unusual login events. For example, when a user's login failure is detected, the system can compare whether the user engaged in high-risk social behaviors (such as forwarding malicious links or joining phishing groups) within an hour of the failed login. Furthermore, within a time window (e.g., one hour), the system collects statistics on the user's social behaviors, such as whether they forwarded content containing malicious links or participated in unusual group discussions. These behaviors are often associated with attacks such as social engineering and malicious dissemination.

[0256] Step S704: Generate a social behavior feature vector based on the graph algorithm analysis results and the time correlation analysis results.

[0257] Among them, the social behavior feature vector includes graph structure features (such as PageRank score, shortest path length), time matching (such as behavior matching score after abnormal events) and social behavior features (such as the frequency of forwarding malicious links and the probability of associating attackers).

[0258] Specifically, graph structure features can describe the importance of users in social networks and the closeness of their relationship with potential attackers; temporal matching is used to evaluate whether social behavior is associated with abnormal login events. A high matching degree indicates that the behavior may be malicious behavior of the attacker; social behavior features can directly reflect the strength of the association between users and attack behaviors.

[0259] It is understandable that by combining the results of graph algorithm analysis with the results of time correlation analysis, the generated social behavior feature vector can comprehensively reflect the user's social behavior risks, providing more accurate data support for subsequent attack identification and risk assessment, and helping the defense system identify potential attack behaviors and high-risk users in complex social environments.

[0260] The above implementation generates user social behavior feature vectors from multiple dimensions (including social graphs, time series, and behavioral characteristics), enabling accurate identification of potential attack behaviors. Through encryption of sensitive information and regional aggregation, user privacy is protected while retaining key social behavior characteristics. The combination of graph algorithms and temporal correlation analysis enables the system to extract high-value security information from users' social interactions and behavioral patterns, providing solid data support for attack identification and protection strategies.

[0261] An embodiment of the present application also discloses a network attack tracing system based on user portraits.

[0262] A network attack tracing system based on user portraits, including:

[0263] The interactive behavior collection module is used to collect user interactive behavior data on web pages; interactive behavior data includes DOM node change records, mouse track coordinates, page scrolling position, input content and timestamps;

[0264] The data processing module is used to compress and serialize the interaction behavior data to generate structured interaction log files;

[0265] Fingerprint data collection module, used to collect user terminal fingerprint data through the browser environment interface; user terminal fingerprint data includes device model, screen resolution, GPU rendering characteristics, IP address, time zone information and WebGL fingerprint;

[0266] A standardization processing module is used to perform standardization processing on the user terminal fingerprint data and generate a fingerprint feature vector;

[0267] The identifier generation module is used to generate a unique user identifier containing a risk level label using a dynamic hash algorithm based on the structured interaction log file and the fingerprint feature vector;

[0268] Cluster analysis module, used to perform cluster analysis on interactive behavior data based on user unique identifiers, identify abnormal behavior patterns of abnormal users and mark attack types;

[0269] The positioning module is used to obtain the public IP address of abnormal users and locate their geographic location based on the IP database;

[0270] The attack tracing module is used to build an attack tracing report based on the user's unique identifier, abnormal behavior pattern, public IP address, and geographic location.

[0271] A network attack tracing system based on user portraits in an embodiment of the present application can implement any of the above-mentioned network attack tracing methods, and the specific working processes of each module in the network attack tracing system can refer to the corresponding processes in the above-mentioned method embodiments.

[0272] In the several embodiments provided in this application, it should be understood that the provided methods and systems can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for example, the division of a module is merely a logical functional division, and in actual implementation, other division methods may be used, such as combining or integrating multiple modules into another system, or ignoring or not implementing certain features.

[0273] The embodiment of the present application also discloses a computer device.

[0274] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, a network attack tracing method based on user profiling as described above is implemented.

[0275] The embodiment of the present application also discloses a computer-readable storage medium.

[0276] A computer-readable storage medium stores a computer program that can be loaded by a processor and executed by any one of the above-mentioned network attack tracing methods based on user portraits.

[0277] Among them, computer-readable storage media can be any tangible medium that contains or stores a program that can be used by or in combination with an instruction execution system, apparatus or device; the program code contained on the computer-readable medium can be transmitted using any appropriate medium, including but not limited to wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0278] It should be noted that, in the above embodiments, the description of each embodiment has different emphases. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0279] The above are all preferred embodiments of the present application and are not intended to limit the scope of protection of this application. Unless otherwise specified, any feature disclosed in this specification (including the abstract and drawings) may be replaced by other equivalent or similar features. In other words, unless otherwise specified, each feature is merely an example of a series of equivalent or similar features.

Claims

1. A network attack tracing method based on user portrait, characterized in that: The attack source tracing method includes: Collect user interaction behavior data on web pages; the interaction behavior data includes DOM node change records, mouse track coordinates, page scrolling position, input content and timestamp; Compressing and serializing the interaction behavior data to generate a structured interaction log file; Collect user terminal fingerprint data through the browser environment interface; the user terminal fingerprint data includes device model, screen resolution, GPU rendering characteristics, IP address, time zone information and WebGL fingerprint; Standardizing the user terminal fingerprint data to generate a fingerprint feature vector; Based on the structured interaction log file and the fingerprint feature vector, a user unique identifier including a risk level label is generated by a dynamic hash algorithm; Performing cluster analysis on the interaction behavior data according to the user unique identifier to identify abnormal behavior patterns of abnormal users and mark the attack type; Obtain the public IP address of the abnormal user and locate the geographic location based on the IP database; Construct an attack tracing report based on the abnormal user's unique user identifier, abnormal behavior pattern, public IP address, and geographic location; The step of generating a user unique identifier including a risk level label by a dynamic hash algorithm based on the structured interaction log file and the fingerprint feature vector includes: Collecting a time series of interactive behavior data in the structured interactive log file; the time series includes operation intervals and behavioral pattern characteristics; Based on a pre-configured weight coefficient matrix, a high weight value is assigned to the unconventional operation according to the characteristics of the behavior pattern, and the operation interval time is weighted and summed to calculate the behavior consistency score; Collect hardware features from user terminal fingerprint data; the hardware features include device model, screen resolution, and GPU rendering parameters; Hash the hardware features and calculate the device stability score based on the matching degree between the hash value and the preset trusted device library; Based on the behavior consistency score and the device stability score, a risk level score is generated through a linear combination formula, and a corresponding risk level label is determined; The hashed hardware feature and the risk level tag are encoded to obtain a unique user identifier.

2. A network attack tracing method based on user portrait according to claim 1, characterized in that: The steps of performing cluster analysis on the interaction behavior data according to the user unique identifier, identifying abnormal behavior patterns of abnormal users and marking attack types include: Grouping the interaction behavior data according to the user unique identifier, and extracting the operation path sequence, time series features, and interaction intensity features from the interaction behavior data; Perform sliding window segmentation on the time series features and calculate the click frequency and scrolling speed within the window; Performing operation path word segmentation processing on the operation path sequence to generate operation path segments; Normalizing the click frequency, scrolling speed, operation path segment, and interaction intensity features to obtain user behavior characteristics; Inputting the user's behavior characteristics into a clustering algorithm to generate a user behavior clustering result; Based on the user behavior clustering results, calculating the Mahalanobis distance between the user's behavior characteristics and the cluster center, and marking users whose Mahalanobis distance exceeds a preset abnormality threshold as abnormal users; Performing pattern analysis on the behavioral characteristics of the abnormal user to identify abnormal behavior patterns; The behavioral characteristics and abnormal behavior patterns of the abnormal user are input into a pre-trained classification model to obtain an attack type label.

3. A network attack tracing method based on user portrait according to claim 2, characterized in that: The steps of performing pattern analysis on the behavioral characteristics of the abnormal user and identifying the abnormal behavior pattern include: Based on the user behavior clustering results, a user behavior benchmark template is constructed; wherein the user behavior benchmark template includes a regular operation path segment library, a time series feature mean and a standard deviation; Calculating the difference between the abnormal user's behavior characteristics and the user behavior benchmark template, including path difference, click frequency deviation, and scrolling speed deviation; Compare the difference with the preset difference threshold and mark the abnormal behavior label; Perform weighted fusion based on the difference to generate a comprehensive anomaly score and determine a comprehensive anomaly level; The abnormal behavior pattern is obtained by combining the abnormal behavior label and the comprehensive abnormality level.

4. A network attack tracing method based on user portrait according to any one of claims 1 to 3, characterized in that: After building the attack source tracing report, the following steps are also included: Performing threat intelligence correlation on the attack source tracing report based on a preset threat intelligence database to obtain a threat intelligence correlation result; Calculate an attack risk score based on the threat intelligence correlation results; Generate a disposal priority list based on the attack risk score, and call a preset strategy library to match the response strategy; Based on the priority list and response strategy, execute the policy instructions through the security orchestration platform and record the policy execution status and result log; Monitor changes in attack indicators after policy execution, evaluate policy effectiveness, and update the preset threat intelligence library and preset policy library.

5. A network attack tracing method based on user portrait according to claim 4, characterized in that: The attack source tracing method further includes: Obtaining social networking site data associated with the abnormal user; wherein the social networking site data includes public metadata and social graph data; Performing sensitive information filtering and correlation analysis on the social networking site data to generate a social behavior feature vector; Fusion of the social behavior feature vector with the fingerprint feature vector and interaction behavior data to generate a multi-dimensional user portrait; Based on the multi-dimensional user portrait, the risk attributes of the multi-dimensional user portrait are integrated into the attack tracing report to form an enhanced attack tracing report; According to the enhanced attack tracing report, the matching logic of the response strategy in the preset strategy library is dynamically adjusted.

6. A network attack tracing method based on user portrait according to claim 5, characterized in that: The steps of filtering sensitive information and performing correlation analysis on the social networking site data to generate a social behavior feature vector include: Hash-encrypting the user identification information in the social networking site data, deleting the original user identifier in the social relationship chain, and performing regional aggregation on the geographic location information to obtain filtered social networking site data; Build a social graph based on filtered social networking site data, apply graph algorithms to identify key nodes and risk-related paths, and obtain graph algorithm analysis results; Perform time series correlation analysis on filtered social networking site data, aligning social behavior timestamps with abnormal login event times, and counting high-risk behaviors within a specified time window after the abnormal login event to obtain time correlation analysis results; Based on the graph algorithm analysis results and the time correlation analysis results, a social behavior feature vector is generated.

7. A network attack tracing system based on user portrait, characterized in that: The attack tracing system includes: The interactive behavior collection module is used to collect user interactive behavior data on Web pages; the interactive behavior data includes DOM node change records, mouse track coordinates, page scrolling position, input content and timestamp; A data processing module, configured to compress and serialize the interaction behavior data to generate a structured interaction log file; Fingerprint data collection module, used to collect user terminal fingerprint data through the browser environment interface; the user terminal fingerprint data includes device model, screen resolution, GPU rendering characteristics, IP address, time zone information and WebGL fingerprint; A standardization processing module, configured to perform standardization processing on the user terminal fingerprint data to generate a fingerprint feature vector; An identifier generation module, configured to generate a user unique identifier including a risk level label by a dynamic hash algorithm based on the structured interaction log file and the fingerprint feature vector; A cluster analysis module, configured to perform cluster analysis on the interaction behavior data according to the user unique identifier, identify abnormal behavior patterns of abnormal users and mark attack types; A positioning module is used to obtain the public IP address of the abnormal user and locate the geographical location in combination with the IP database; An attack tracing module is used to construct an attack tracing report based on the user's unique identifier, abnormal behavior pattern, public IP address, and geographic location of the abnormal user; The identifier generation module is configured to: Collecting a time series of interactive behavior data in the structured interactive log file; the time series includes operation intervals and behavioral pattern characteristics; Based on a pre-configured weight coefficient matrix, a high weight value is assigned to the unconventional operation according to the characteristics of the behavior pattern, and the operation interval time is weighted and summed to calculate the behavior consistency score; Collect hardware features from user terminal fingerprint data; the hardware features include device model, screen resolution, and GPU rendering parameters; Hash the hardware features and calculate the device stability score based on the matching degree between the hash value and the preset trusted device library; Based on the behavior consistency score and the device stability score, a risk level score is generated through a linear combination formula, and a corresponding risk level label is determined; The hashed hardware feature and the risk level tag are encoded to obtain a unique user identifier.

8. A computer device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 6 when executing the program.

9. A computer-readable storage medium, characterized in that: A computer program is stored which can be loaded by a processor and execute the method according to any one of claims 1 to 6.

Images