A detection method and device for brute force cracking behavior

Abstract

The embodiments of the present invention provide a method and device for detecting a brute force cracking behavior, which acquires statistical message information within a preset time period, determines from the message information that the destination port is the target quintuple information of the first port of the target server, and The second statistical value of the target corresponding to the target quintuple information, and extract the first baseline and the second baseline, calculate the first difference between the second statistical value of the target and the first baseline, and the difference between the second statistical value of the target and the second baseline. The second gap value, if the second gap value is smaller, it means that the target second statistic value is that the log-in failure is more likely to be the generated statistic value. If the number of target quintuple information for which the login behavior result is a login failure within a preset period of time exceeds a certain threshold, it means that the number of login failures among the multiple login behaviors within the preset period of time is relatively large, and it can be determined that Such a login behavior is a suspected brute force cracking behavior, which improves the detection accuracy of the brute force cracking behavior.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a detection method and device for brute force cracking behavior. Background technique [0002] As users have more types and larger demands on network services, the security of network services becomes more and more important. When a user accesses a network service, he needs to input an account number and a password, and the server verifies the account number and password, and after passing the verification, the user is allowed to access the network service. Brute force cracking behavior means that the attacker simulates the user's login behavior by trying all possible accounts and passwords. After the attacker cracks the user's account and password, he can use the account and password to perform illegal operations and bring losses to the user. [0003] When brute force cracking occurs, the attacker will frequently send verification messages including account numbers...

AI Technical Summary

Problems solved by technology

[0004] However, when the server is running normally, in addition to the messages generated by user login, the server and other devices will also interact with other devices normally. Normal message interaction will be identified as brute force cracking behavior, resulting in poor detection accuracy of brute force cracking behavior

Images