Method for discovering intranet attacker based on windows login information

Abstract

The invention provides a method for discovering an intranet attacker based on windows login information, which comprises the following steps that: in an enterprise intranet, each server is provided with a windows operating system, an agent server is set, and an agent client program is installed in each server in a protection range; the agent server is responsible for maintaining a login information white list and respectively issuing the login information white list to agent client programs in servers in each protection range; the agent client program in each server within the protection rangeis responsible for detecting login information of the agent client program, if the login information is not in the white list and is judged to be an attacker, login is refused, and alarm informationis pushed to the agent server at the first time. According to the method, an attacker is found by maintaining a login information white list, massive log analysis is not needed, and the method is simple, high in efficiency and good in safety.

Description

technical field [0001] The invention relates to the field of network security, in particular to a method for discovering attackers in an internal network based on windows login information. Background technique [0002] With the rapid development of global informatization and the in-depth research of information technology, network security has become an important issue that people pay more and more attention to. Whether it is an individual or an enterprise, cyber attacks are potential threats that exist all the time. If the enterprise intranet is illegally invaded, it may cause immeasurable losses. There are generally the following methods for detecting intranet attacks: honeypots, antivirus software, and EDR. In essence, honeypot technology is specially set up to lure attackers to attack it. By capturing and analyzing the attack behavior, we can understand the tools and methods used by the attacker, and speculate on the attack intention and motivation. You can also coll...

AI Technical Summary

Problems solved by technology

[0005] 1. Large-scale enterprise intranet protection usually sends its own logs to the log server for log backup. The log server needs to maintain a large amount of log information, with a large business volume and a long protection line. The summary and analysis of data is complex and difficult. ,low efficiency

[0006] 2. The honeypot itself may be used as a springboard to attack other users, causing irreparable losses and legal liability issues;

[0007] 3. Anti-virus software may be killed by hackers, and there are still problems of file accidental killing and data destruction during the virus killing process

At the same time, anti-virus software cannot kill all viruses, and the timely update of the virus database is an existing problem;

[0008] 4. EDR requires a dedicated security operation team to manually investigate event alerts, and the labor cost is high

The console screens massive amounts of information for abnormal login logs and sends out alerts. Security teams are often bombarded with massive alerts from multiple security consoles. Investigation decisions may be made with insufficient information, or Hasty summary judgments and imprecise decision-making;

[0009] 5. The processing methods of existing technologies depend more on the technical level of the attacker, and there is a possibility of being bypassed

Images