Account leakage detection method and system for generating secret account based on character features
By generating a confidential account and using character characteristics to generate a honey account, the problems of ease of use and scalability of honey language are solved, timely detection and privacy protection of account leakage are achieved, and the deception ability and security of honey accounts are improved.
Patent Information
- Application Number
- CN202510446438.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-04-10
- Publication Date
- 2025-07-04
AI Technical Summary
In the prior art, the ease of use and scalability of Miyu is challenged by changes in the server storage structure, and credential theft incidents on personal devices are difficult to achieve full protection on the server.
By generating a secret account, using character features to generate honey accounts, disturbing the character set of the original account name, forming a honey account set, and storing it on the server side, using Jensen-Shannon similarity and Jaccard similarity to judge the similarity of the account name, and improving deception ability.
It enhances the privacy protection of user information, improves the deception ability of honey accounts, can detect account leakage in a timely manner and take security measures to prevent attackers from obtaining real accounts.
Smart Images
Figure CN120263491A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical fields of network security and data encryption, and in particular to an account leakage detection method and system for generating encrypted accounts based on character features. Background Art
[0002] The network security situation is becoming increasingly severe, and large-scale account password leakage incidents are not uncommon. After a password leakage incident occurs, there are generally problems such as a long detection and disposal cycle and untimely security remedies. The Honeywords technology can effectively solve the problem of detection lag in password data leakage, but it still faces many challenges in actual use.
[0003] First of all, the use of honeywords is accompanied by some inherent password security problems, such as user password reuse, non-random distribution of user passwords, and personal information contained in passwords. These problems make it difficult to generate reliable honeywords to deceive attackers.
[0004] Secondly, honeywords require multiple passwords to be stored for each account, which means that the server needs to change the storage structure of account data, making the usability and scalability of honey passwords face challenges. Moreover, credential theft incidents on personal devices also occur frequently, and honeywords are mainly deployed on the server, making it difficult to achieve comprehensive protection of account data. Honey accounts can alleviate some of the problems faced by current honey passwords. The deception ability of honey accounts lies in their similarity to real accounts. However, there is still a lack of sufficient research on the method for generating honey account names.
[0005] Account names contain user personalities and habits. Users usually choose familiar account names or create new account names according to existing patterns. Identity alignment and integration are important for social network research and can help provide personalized recommendation services and discover false identities. Identity identity algorithms use registration information for identity discrimination. Due to privacy and false information, account names have become important features for discriminating user identities. Research has found that users use similar account names in different social networks and show a high degree of similarity in character distribution. Using the character string features of account names for identity discrimination has achieved good results, and encrypted accounts can be generated.
[0006] The existing technologies have the following technical problems: (1) Honeywords require multiple passwords to be stored for each account, which means that the server needs to change the storage structure of account data, making the usability and scalability of honeywords face challenges; (2) Credential theft incidents on personal devices occur frequently, and honeywords are mainly deployed on the server, making it difficult to achieve comprehensive protection of account data. Summary of the Invention
[0007] To solve the above technical problems, the present invention provides an account leakage detection method and system for generating honey accounts based on character features, which improves the prior art and enhances the security of the authentication system and the protection level of user information.
[0008] To achieve the above object, the technical solution adopted by the present invention is: providing an account leakage detection method for generating honey accounts based on character features, including the following steps:
[0009] S1 Registration stage, the user sets the original account name and original password, and sends them to the server. An empty set is created on the server to store the original account name and honey accounts.
[0010] S2 Generate honey accounts. Extract the characters in the original account name u = c1, c2, c3,..., c n to form the corresponding character set char u . Define a perturbation function θ and perform a perturbation strategy on the character set char u . After perturbation, obtain the string θ(char u ), that is, the account variant, and fill it into the honey account set. When the required number of account variants is reached, stop generating.
[0011] S3 Send the index. After the server generates the honey account set, insert the original account name into the honey account set and scramble it to generate a honey account sequence, which is added to the server database. According to the length of the original password, generate the ciphertext corresponding to the honey account, and send the index of the original account name to the honey account authentication end.
[0012] S4 Login stage, the user enters the account name and password. The server searches for the index corresponding to the account name in the honey account sequence, sends the index to the honey account authentication end for authentication, and determines whether the account name index is the same as the index of the original account name stored in the honey language authentication end.
[0013] Preferably, the specific method of the perturbation strategy is any one of the following:
[0014] (1) Add k characters to the character set char u so that after adding the characters, the inequality is satisfied and JS sim (char u , θ(char u )) > 0.8;
[0015] (2) Delete k characters from the character set char u so that after deleting the characters, the inequality 0.8 < length(θ(char u )) / length(char u ) is satisfied, and JS sim(char u , θ(char u )) > 0.8;
[0016] (3) Select k characters from the character set char u for replacement. After replacement, the character set satisfies the inequality JS sim (char u , θ(char u )) > 0.8, Jac sim (char u , θ(char u )) > 0.5;
[0017] (4) Select k characters from the character set char u and insert them into the character set char u . After insertion, the character set satisfies the inequality JS sim (char u , θ(char u )) > 0.8;
[0018] Among them, JS sim represents the Jensen - Shannon similarity, and Jac sim represents the Jaccard similarity.
[0019] Preferably, the Jaccard similarity is used to compare the similarity of two sets, and the calculation process is as follows:
[0020]
[0021] Among them, len represents the length of the character set, set(u i ), set(u j ) represent two character sets, ∩ represents the intersection of the two sets, ∪ represents the union of the two sets. For different honey account sets, the greater the Jaccard similarity, the higher the similarity of the honey account sets.
[0022] Preferably, the calculation process of the Jensen - Shannon similarity is as follows:
[0023]
[0024] Among them, KL represents the divergence, which is an asymmetric measure of the difference between two character distributions P and Q. P i or Q i represents the probability that the i - th character appears. To avoid the situation where P i or Q i is 0, a very small value e is used for smoothing, and M represents the average distribution of the two character distributions P and Q.
[0025] Preferably, the process of S4 for judging whether the indexes are the same is as follows:
[0026] When the indexes are the same, the honey account authentication end sends a message of successful authentication back to the server. After receiving this message, the server verifies the password and then returns a signal of successful login to the client, allowing the user to access their account;
[0027] When the indexes are different, after receiving the account name, the server determines whether the account name exists in the honey account sequence.
[0028] Preferably, after determining whether the account name exists in the honey account sequence, it further includes:
[0029] If it does not exist, the server directly returns a message of failed login to the user;
[0030] If it exists, the server notifies the user of failed login and additionally prompts the risk of account information leakage. At the same time, the server also records the event of logging in with the honey account in the internal security log and activates security measures.
[0031] Preferably, after receiving the risk of account information leakage, the user chooses to modify the password or cancel the account;
[0032] When the user chooses to modify the password, first enter the new password. After the server receives the request, it updates the password of the corresponding account and then synchronously updates the secret words of the remaining honey accounts, generating secret words according to the length of the new password;
[0033] When the user chooses to cancel the account or the administrator needs to remove a user from the system, after the server receives the deletion request, it locates all relevant data records of the user in the database, and then the server executes the deletion command.
[0034] Preferably, the process of generating the secret word corresponding to the honey account in S3 is as follows: extract the characters in the original password to form a corresponding character set, define a perturbation function, perform a perturbation strategy on the character set, and the obtained string after perturbation is the generated secret word corresponding to the honey account, and each honey account corresponds to a secret word.
[0035] The present invention also provides an account leakage detection system for generating honey accounts based on character features, including:
[0036] A registration module for the user to set the original account name and original password, send them to the server, and create an empty set on the server to store the original account name and honey accounts;
[0037] A honey account generation module for extracting the original account name u = c1, c2, c3,..., c nThe characters in it form the corresponding character set char u , define a perturbation function θ to perturb the character set char u using a perturbation strategy. After perturbation, the string θ(char u ) is obtained, which is the account variant. Fill it into the set of honey accounts. When the required number of account variants is reached, stop generating;
[0038] The sending index module is used to, after the server generates the set of honey accounts, insert the original account name into the set of honey accounts for scrambling to generate a honey account sequence, add it to the server database, generate a secret message corresponding to the honey account according to the length of the original password, and send the index of the original account name to the honey account authentication end;
[0039] The login module is used for the user to input the account name and password. The server searches for the index corresponding to the account name in the sequence of encrypted accounts, sends the index to the honey account authentication end for authentication, and determines whether the index of the account name is the same as the index of the original account name stored in the honey language authentication end.
[0040] The above technical solution has the following advantages or beneficial effects:
[0041] The privacy protection of the present invention is enhanced. Through the method of honey accounts, even if the server is attacked, the attacker cannot directly obtain the real accounts of users; the present invention proposes to generate encrypted accounts based on character features, which has a certain improvement in similarity with the initial accounts and improves the deception ability of the honey accounts.
[0042] The above summary is only for the purpose of the specification and is not intended to be limiting in any way. In addition to the illustrative aspects, embodiments and features described above, further aspects, embodiments and features of the present invention will be readily apparent by reference to the drawings and the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS
[0043] In the drawings, unless otherwise specified, the same reference numerals throughout the several views denote the same or similar components or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings only depict some embodiments disclosed in accordance with the present invention and should not be regarded as limiting the scope of the present invention.
[0044] Figure 1 It is a flowchart of the registration stage of an account leakage detection method for generating encrypted accounts based on character features provided by the present invention;
[0045] Figure 2 It is a flowchart of the login stage of an account leakage detection method for generating encrypted accounts based on character features provided by the present invention;
[0046] Figure 3Flowchart of the deletion user stage of an account leakage detection method for generating a honey account based on character features provided by the present invention;
[0047] Figure 4 Structural diagram of an account leakage detection system for generating a honey account based on character features provided by the present invention. Detailed implementation manners
[0048] In the following, only some exemplary embodiments are briefly described. As those skilled in the art can recognize, the described embodiments can be modified in various different ways without departing from the spirit or scope of the present invention. Therefore, the drawings and descriptions are considered to be exemplary in nature and not restrictive.
[0049] The present invention first provides an account leakage detection method for generating a honey account based on character features, including the following steps:
[0050] S1 Registration stage
[0051] The user sets the original account name and original password and sends them to the server. An empty set is created on the server to store the original account name and the honey account;
[0052] S2 Generate honey account
[0053] Extract the characters in the original account name u = c1, c2, c3,..., c n to form the corresponding character set char u , define a perturbation function θ, perform a perturbation strategy on the character set char u , and after perturbation, obtain the string θ(char u ), that is, the account variant, and fill it into the honey account set. When the required number of account variants is reached, stop generating;
[0054] The specific method of the perturbation strategy is any one of the following:
[0055] (1) Add k characters to the character set char u so that after adding the characters, the inequality is satisfied and JS sim (char u , θ(char u )) > 0.8;
[0056] (2) Delete k characters from the character set char u so that after deleting the characters, the inequality 0.8 < length(θ(char u )) / length(char u ) is satisfied, and JS sim (charu , θ(char u )) > 0.8;
[0057] (3) Select k characters from the character set char u for replacement. After replacement, the character set satisfies the inequality JS sim (char u , θ(char u )) > 0.8, Jac sim (char u , θ(char u )) > 0.5;
[0058] (4) Select k characters from the character set char u and insert them into the character set char u . After insertion, the character set satisfies the inequality JS sim (char u , θ(char u )) > 0.8;
[0059] Among them, JS sim represents Jensen-Shannon similarity, and Jac sim represents Jaccard similarity.
[0060] The Jaccard similarity is used to compare the similarity of two sets, and the calculation process is as follows:
[0061]
[0062] Among them, len represents the length of the character set, set(u i ), set(u j ) represent two character sets, ∩ represents the intersection of the two sets, ∪ represents the union of the two sets. For different honey account sets, the greater the Jaccard similarity, the higher the similarity of the honey account sets.
[0063] Character distribution refers to the probability of each letter appearing in an account. For two similar account names, their character distributions should also be similar. The present invention uses Jensen-Shannon Similarity to measure the character distribution similarity feature.
[0064] The Jensen-Shannon (JS) similarity is defined by the Jensen-Shannon distance (JSD), which is a symmetric, normalized, non-negative distance metric used to compare the probability distributions P and Q of the letters in two account names. The value range of the JS similarity is between 0 and 1, where 0 indicates that the two distributions are completely different and 1 indicates that the two distributions are exactly the same;
[0065] The calculation process of the JS similarity is as follows:
[0066]
[0067] where KL represents the divergence, which is an asymmetric metric for measuring the difference between two probability distributions P and Q. P i or Q i represents the probability of the i-th character appearing. To avoid the situation where P i or Q i is 0, a very small value e is used for smoothing. M represents the average distribution of the two probability distributions P and Q.
[0068] S3 sends the index.
[0069] After the server generates the set of honey accounts, it inserts the original account name into the set of honey accounts, shuffles it to generate a honey account sequence, adds it to the server database, generates a secret phrase corresponding to the honey account according to the length of the original password, and sends the index of the original account name to the honey account authentication end;
[0070] The process of generating the secret phrase corresponding to the honey account is as follows: Extract the characters in the original password to form a corresponding character set, define a perturbation function, perform a perturbation strategy on the character set, and the resulting string is the secret phrase generated for the honey account. Each honey account corresponds to a secret phrase.
[0071] S4 Login phase
[0072] The user enters the account name and password. The server searches for the index corresponding to the account name in the sequence of honey accounts. As Figure 2 shown, it sends the index to the honey account authentication end for authentication. The honey account authentication end has a complete index database for determining whether the index is the same as the index of the original account name stored in the honey account authentication end.
[0073] When the indexes are the same, it means that the user has entered the original account name. The honey account authentication end will send an authentication success message back to the server. After receiving this message, the server verifies the password and then returns a login success signal to the client, allowing the user to access their account.
[0074] When the indexes are different, after receiving the input account name, the server first determines whether the account name exists in the honey account sequence.
[0075] If it does not exist, the server directly returns a login failure message to the user without further specifying the reason.
[0076] If it exists, it means there is a potential risk of the account being cracked. In this case, in addition to notifying the client of the login failure, the server will also additionally prompt the risk of account information leakage to remind the user that the security of their account may be threatened. At the same time, the server will also record the event of logging in with the honey account in the internal security log and initiate security measures.
[0077] The specific security measures are as follows: Prompt the affected users to modify their login accounts. By analyzing the web log or checking the number of network connections, when the concurrent connection number of a certain IP is too large, call the firewall command to block the corresponding IP.
[0078] In addition, the login failure times limit can also be set. After exceeding the limit times, the account will be automatically locked and identity verification is required to unlock it. At the same time, regularly scan the system for vulnerabilities and conduct security assessments to ensure the security of the system.
[0079] After receiving the risk of account information leakage, the user chooses to modify the password or cancel the account;
[0080] When the user chooses to modify the password, first enter the new password. After the server receives the request, update the password of the corresponding account, and then synchronously update the secret words of the other honey accounts, and generate the secret words according to the length of the new password;
[0081] When the user chooses to cancel the account or the administrator needs to remove a user from the system, after the server receives the deletion request, locate all the relevant data records of the user in the database, and then the server executes the deletion command; immediately afterwards, in order to maintain the overall data consistency and security of the system, the server will send a notification message with the account to the honey account authentication end. When the honey account authentication end receives this message, it will retrieve the index information corresponding to the account in the database it is responsible for. After finding the corresponding index, the honey account authentication end also performs a deletion operation to ensure that all the security verification materials associated with the account are synchronously removed, as Figure 3 shown.
[0082] The present invention also provides an account leakage detection system for generating honey accounts based on character features, the structure of which is as Figure 4 shown, including:
[0083] A registration module, which is used for the user to set the original account name and original password, send them to the server, and create an empty set on the server to store the original account name and the honey account;
[0084] The honey account generation module is used to extract the characters in the original account name u=c1, c2, c3, ..., c n to form the corresponding character set char u , define a perturbation function θ, and perform a perturbation strategy on the character set char u to obtain the string θ(char u ), that is, the account variant, and fill it into the honey account set. When the required number of account variants is reached, stop generating;
[0085] The sending index module is used to, after the server generates the honey account set, insert the original account name into the honey account set to scramble and generate the honey account sequence, add it to the server database, generate the secret language corresponding to the honey account according to the length of the original password, and send the index of the original account name to the honey account authentication end;
[0086] The login module is used for the user to input the account name and password. The server searches for the index corresponding to the account name in the encrypted account sequence, sends the index to the honey account authentication end for authentication, and determines whether the account name index is the same as the index of the original account name stored in the secret language authentication end.
[0087] The above technical solution has the following advantages or beneficial effects: The privacy protection of the present invention is enhanced. Through the honey account method, even if the server is attacked, the attacker cannot directly obtain the user's real account; the present invention proposes to generate honey accounts based on character features, which has a certain improvement in similarity with the initial account and improves the deception ability of the honey account.
[0088] In the description of this specification, the description with reference to terms such as "one embodiment", "one preferred embodiment", "example", "specific example", or "some examples" means that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. Moreover, the specific features, structures, materials, or characteristics described can be combined in a suitable manner in any one or more embodiments or examples. In addition, without contradiction, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.
[0089] Any process or method description represented in a flowchart or otherwise described herein can be understood to represent a module, segment, or portion of code including one or more executable instructions for implementing a specific logical function or process. The scope of the preferred embodiments of the present invention includes additional implementations where functions may be executed not in the order shown or discussed, including in a substantially simultaneous manner according to the functions involved or in a reverse order, which should be understood by those skilled in the art to which the embodiments of the present invention pertain.
[0090] The logic and / or steps represented in a flowchart or otherwise described herein, for example, can be considered a sequenced list of executable instructions for implementing a logical function and can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, a system including a processor, or other systems that can fetch and execute instructions from the instruction execution system, apparatus, or device. For the purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of the computer-readable medium include the following: an electrical connection having one or more wires (electronic device), a portable computer diskette (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium can even be paper or other suitable medium on which the program can be printed, as the program can be obtained, for example, by optically scanning the paper or other medium, followed by editing, interpretation, or other appropriate processing as necessary to obtain the program in electronic form and then storing it in a computer memory.
[0091] It should be understood that the various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, any one of the following techniques known in the art or a combination thereof can be used: discrete logic circuits having logic gates for implementing logical functions on data signals, application specific integrated circuits having appropriate combinational logic gates, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.
[0092] Those of ordinary skill in the art can understand that all or part of the steps carried out in implementing the above-described embodiment methods can be completed by instructing relevant hardware through a program. The program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiments. Among them, the device implementation mode corresponds to the method implementation mode. Therefore, the description of the device implementation mode is relatively brief, and the relevant description can refer to the description of the method implementation mode.
[0093] In addition, in each embodiment of the present invention, the functional units can be integrated into one processing module, or each unit can exist physically alone, or two or more units can be integrated into one module. The above integrated module can be implemented in the form of hardware or in the form of a software functional module. When the above integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. The storage medium can be a read-only memory, a magnetic disk, an optical disc, etc.
[0094] The above is only the specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present invention can easily think of various changes or substitutions, and these should all be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.
Claims
1. An account leakage detection method for generating a secret account based on character features, characterized in that It includes the following steps: S1 Registration stage; The user sets the original account name and original password and sends them to the server. An empty set is created on the server to store the original account name and honey accounts; S2 Generate honey accounts; Extract the characters in the original account name u = c1, c2, c3,..., c n to form the corresponding character set char u , define a perturbation function θ, and perform a perturbation strategy on the character set char u to obtain the string θ(char u ), that is, the account variant, fill it into the honeypot account set, and stop generating when the required number of account variants is reached; S3 Send indexes; After the server generates the honey account set, it inserts the original account name into the honey account set, shuffles it to generate a honey account sequence, adds it to the server database, generates the secret language corresponding to the honey account according to the length of the original password, and sends the index of the original account name to the honey account authentication end; S4 Login stage; The user enters the account name and password. The server searches for the index corresponding to the account name in the honey account sequence, sends the index to the honey account authentication end for authentication, and judges whether the account name index is the same as the index of the original account name stored in the honey language authentication end. If they are different, it judges whether it exists in the honey account sequence. If it exists, a risk prompt of login failure and honey account leakage is returned to the user. If it does not exist, a login failure is returned to the user.
2. The account leakage detection method for generating a secret account based on character features according to claim 1, wherein: The specific method of the perturbation strategy is any one of the following: (1) Add k characters to the character set char u After adding the characters, the inequality is satisfied and JS sim (char u , θ(char u )) > 0.8; (2) Delete k characters from the character set char u such that after deletion, the inequality 0.8 < length(θ(char u )) / length(char u ) holds, and JS sim (char u , θ(char u )) > 0.8; (3) Select k characters from the character set char u for replacement. After replacement, the character set satisfies the inequality JS sim (char u , θ(char u )) > 0.8, and Jac sim (char u , θ(char u )) > 0.5; (4) Select k characters from the character set char u and insert them into the character set char u . After the insertion, the character set satisfies the inequality JS sim (char u , θ(char u )) > 0.8; Among them, JS sim represents Jensen-Shannon similarity, and Jac sim represents Jaccard similarity.
3. The account leakage detection method for generating a secret account based on character features according to claim 2, characterized in that: The Jaccard similarity is used to compare the similarity of two sets, and the calculation process is as follows: where len represents the length of the character set, set(u i ) and set(u j ) represent two character sets, ∩ represents the intersection of the two sets, ∪ represents the union of the two sets. For different sets of honey accounts, the greater the Jaccard similarity, the higher the similarity of the sets of honey accounts.
4. The account leakage detection method for generating a secret account based on character features according to claim 2, wherein: The calculation process of the Jensen-Shannon similarity is as follows: Among them, KL represents the divergence, which is an asymmetric measure of the difference between two character distributions P and Q, where P i or Q i represents the probability of the i-th character appearing. To avoid the situation where P i or Q i is 0, a very small value e is used for smoothing, and M represents the average distribution of the two character distributions P and Q.
5. The account leakage detection method for generating a secret account based on character features as described in claim 1, wherein: The process of S4 judging whether the indexes are the same is as follows: When the indexes are the same, the honey account authentication end sends an authentication success message back to the server. After receiving this message, the server verifies the password and then returns a login success signal to the client, allowing the user to access their account; When the indexes are different, after the server receives the account name, it judges whether the account name exists in the honey account sequence.
6. The account leakage detection method for generating a secret account based on character features according to claim 5, characterized in that: After judging whether the account name exists in the honey account sequence, it also includes: If it does not exist, the server directly returns a login failure message to the user; If it exists, the server notifies the user of login failure and additionally prompts the risk of account information leakage. At the same time, the server will also record the event of logging in with the honey account in the internal security log and start security measures.
7. The account leakage detection method for generating a secret account based on character features according to claim 6, characterized in that: After receiving the risk of the account information leakage, the user chooses to modify the password or cancel the account; When the user chooses to modify the password, first enter the new password. After the server receives the request, it updates the password of the corresponding account, then synchronously updates the secret languages of the other honey accounts, and generates the secret language according to the length of the new password; When the user chooses to cancel the account or the administrator needs to remove a user from the system, after the server receives the deletion request, it locates all relevant data records of the user in the database, and then the server executes the deletion command.
8. The account leakage detection method for generating a secret account based on character features according to claim 1, characterized in that: The process of generating the secret language corresponding to the honey account in S3 is as follows: Extract the characters in the original password to form the corresponding character set, define a perturbation function, perform the perturbation strategy on the character set, and the obtained string after perturbation is the generated secret language corresponding to the honey account, and each honey account corresponds to a secret language.
9. An account leakage detection system for generating honey accounts based on character features, including: A registration module, which is used for the user to set the original account name and original password, send them to the server, and create an empty set on the server to store the original account name and honey accounts; The honey account generation module is used to extract the characters in the original account name u = c1, c2, c3,..., c n to form the corresponding character set char u , define a perturbation function θ, and perform a perturbation strategy on the character set char u . After perturbation, the obtained string is θ(char u ), which is the account variant. Fill it into the honey account set, and stop generating when the required number of account variants is reached; A sending index module, which is used to, after the server generates a set of honey accounts, insert the original account names into the set of honey accounts to scramble and generate a honey account sequence, add it to the server database, generate a secret language corresponding to the honey accounts according to the length of the original password, and send the index of the original account name to the honey account authentication end; A login module, which is used for the user to input an account name and a password. The server searches for the index corresponding to the account name in the honey account sequence, sends the index to the honey account authentication end for authentication, and determines whether the account name index is the same as the index of the original account name stored in the secret language authentication end.