Brute force attack prevention method, device and system

Abstract

The invention discloses a brute force attack prevention method, device and system. The method, the device and the system are used for improving the brute force attack prevention efficiency of cluster hosts. The method comprises the steps that a server carries out analysis and rule matching on each piece of login information each time after the login information reported by one host in a cluster is received; indicating interception of a login user corresponding to the host reporting any one piece of login information when it is judged that brute force attack behaviors are generated based on any one piece of login information; and directly indicating interception of the login user corresponding to any one host when the login information which is reported by any one host in the cluster and is similar to the login information is further received. In this way, the brute force attack prevention efficiency of the cluster hosts is improved, the hosts in the whole cluster can defense malicious attackers timely, the mutual brute force attacks of the hosts in the cluster are effectively prevented, the realization cost is low, and the realization is easy.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a method, device and system for preventing violent cracking. Background technique [0002] The brute-force cracking prevention system of the traditional Linux Secure Shell (SSH) login authentication system implements single-point defense by configuring the local Linux login authentication module (Pam), that is, defends against a single host. When the brute force cracking behavior that meets the number of times setting occurs, the attacker's IP and account will be added to the blacklist to prevent the attacker from continuing to try. For example, by configuring certain rules and setting a certain number of logins within a certain time threshold, the attacker's IP and account will be added to the blacklist. [0003] However, in a large cluster environment, this defense can only defend against a single host in time, while other hosts are still exposed to the attacker, and the att...

AI Technical Summary

Problems solved by technology

[0006] Embodiments of the present invention provide a method, device, and system for preventing brute-force cracking, which are used to solve the problem in the prior art that the defense efficiency of the mechanism for preventing brute-force cracking of cluster hosts is low, and it is impossible for the hosts of the entire cluster to protect malicious attackers in a timely manner. Defense and unable to defend against mutual brute force attacks between hosts in the cluster

Images