Method and system for detecting credential stuffing attacks

Abstract

The invention discloses a method and system for detecting credential stuffing attacks. The method includes the following steps: receiving and analyzing a user's network access request to determine its source IP, destination IP, login attribute information and user information; configuring a preset login path and The threshold of login times, or the preset format and login times threshold of the system's default built-in identification of the login path; according to the destination IP and login attribute information, the preset login path or the preset format of the login path to identify whether to perform a login operation, and if so, record it Source IP, destination IP, and user information; count the number of logins received by the server with the same destination IP within the preset time with the same source IP but different user information, and determine whether the number of logins reaches the threshold of login times, and if so, it is considered a credential library Attack behavior; if not, it is considered as a normal access behavior. The invention can realize the monitoring of credential stuffing attack behavior, so as to improve the security of user information and avoid adverse consequences caused by leakage of user information.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method and system for detecting credential stuffing attacks. Background technique [0002] At present, most of the websites that allow users to post speeches require users to register before posting speeches. This user registration mechanism is helpful for enterprises to manage users, such as monitoring the remarks and information shared by users; it is also beneficial for users to communicate with users. When users register on many websites, in order to facilitate memory, they often do not use different user accounts and passwords for each website, but usually only use 1 to 3 sets of user accounts and passwords. This situation often leads to serious security problems. When a website user information (including user account number and password) is leaked, the attacker may use the leaked user information to try to log in to other websites, and obtain correct authentica...

AI Technical Summary

Problems solved by technology

However, ordinary users are not aware of this, and there is no correct method and way to know whether their user information has been leaked. Enterprises are helpless in the face of this kind of credential stuffing attack. Once the attacker successfully logs in through the credential stuffing attack The user system can be attacked with higher authority, causing huge losses to the user

Images