Method, system, device and storage medium for brute force attack detection

Abstract

The embodiment of the present invention discloses a brute force attack detection method, system, device, and storage medium, which relate to the field of network security technology. The embodiment of the present invention establishes a multi-stage brute force attack behavior model based on a behavior analysis method, and the model is complete. Describes the whole process of brute force attack, clarifies the characteristics and detection elements of different stages of attack, and provides a basis for confirming the attack result by summarizing the different behavior elements of attack success and attack failure, and solves the problem of judging the result of brute force attack .

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method, system, device and storage medium for brute force attack detection. Background technique [0002] Existing detection and analysis methods for brute force attacks are limited to detecting whether an event occurs, and none of the existing solutions can give results as to whether the brute force attack is successful. In particular, the brute force cracking attacks under the encryption protocol cannot be judged or analyzed by conventional detection methods. At present, there are mainly the following two types of detection methods and technical means: one is to monitor network traffic and set a dangerous threshold. When a large number of suspicious data packets exceed the threshold, an attack is considered to have occurred. The second is to perform feature matching. When it is detected that the content of the data packet contains known threat features, it is determ...

AI Technical Summary

Problems solved by technology

[0007] The purpose of the embodiment of the present invention is to provide a brute force attack detection method, system, device and storage medium to solve the problem that the prior art cannot detect the brute force due to the fact that the detection does not consider the network status and the change of the attacker's behavior after the attack is successful. Crack the question of whether the attack was successful

Images