Method and device for preventing library-hit attacks

Abstract

The application provides a method and a device for preventing library-hit attacks. The method comprises the following steps: counting a number of login times and a login success rate of a same source IP address aiming at a to-be-protected target IP in a default cycle by a server; judging whether the number of login times is greater than a preset login threshold value or not; judging whether the login success rate is smaller than a preset success rate threshold value or not; and when the number of login times is greater than the preset login threshold value and the login success rate is smaller than the preset success rate threshold value, determining that the source IP address has library-heat attack behaviors, and performing protection treatment according to protection actions specified in a preset protection rule. Because the login success rate is introduced into the application to serve as a basis for judgment, and a protection rule is set for a same source IP, the problems of wrong judgment probably caused by concurrent login of a large number of users in a NAT environment in a related technology, and missed judgment probably caused by the library-hit attacks carried out by adopting a password library for a single user are solved.

Description

technical field [0001] The present application relates to the field of network security, in particular to a method and device for protecting against credential stuffing attacks. Background technique [0002] There are currently a large number of Internet sites that require user registration to use. The website adopts the registration mechanism to facilitate the management of users, and is also conducive to the communication between users. In practical applications, when a user registers a personal account on multiple websites, in order to facilitate memory, only a small number of user account numbers and passwords may be set for use on multiple websites. In this case, if user information (including user account number and password) is leaked, the attacker may collect the leaked user account number and password, generate a corresponding dictionary table, and try to log in to the target website in batches to obtain the login information of the target website. User account an...

AI Technical Summary

Problems solved by technology

[0005] In view of this, the present application provides a method and device for protecting against credential stuffing attacks, which are used to solve the problem that related technologies may cause misjudgments when a large number of users log in concurrently in a NAT environment when protecting against credential stuffing attacks. The use of cryptographic databases for credential library attacks may cause missed judgments

Images