Base collision attack detecting method and system

Abstract

The invention discloses a base collision attack detecting method and system. The method includes the following steps: receiving a network access request of a user and analyzing the network access request to determine an source IP, a target IP, login attribute information and user information; configuring a preset login route and a login times threshold or preset format and a login times threshold of a system default built-in login route; conducting identification to determine whether to conduct login operation according to the target IP, the login attribute information and the preset format of the preset login route or the login route, on yes judgment, recording the source IP, the target IP and user information; recording the times of login that servers of the same target IP receives identical source IP but different user information in the preset time, judging if the times of login reach the login times threshold, on yes judgment, assuming the base collision attack behavior, on no judgment, assuming normal access behavior. The method and system can monitor the base collision attack behavior to improve user information safety and avoid poor result caused by user information leakage.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method and system for detecting credential stuffing attacks. Background technique [0002] At present, most of the websites that allow users to post speeches require users to register before posting speeches. This user registration mechanism is helpful for enterprises to manage users, such as monitoring the remarks and information shared by users; it is also beneficial for users to communicate with users. When users register on many websites, in order to facilitate memory, they often do not use different user accounts and passwords for each website, but usually only use 1 to 3 sets of user accounts and passwords. This situation often leads to serious security problems. When a website user information (including user account number and password) is leaked, the attacker may use the leaked user information to try to log in to other websites, and obtain correct authentica...

AI Technical Summary

Problems solved by technology

However, ordinary users are not aware of this, and there is no correct method and way to know whether their user information has been leaked. Enterprises are helpless in the face of this kind of credential stuffing attack. Once the attacker successfully logs in through the credential stuffing attack The user system can be attacked with higher authority, causing huge losses to the user

Images