Brute force attack detection method and system, and equipment

Abstract

The invention discloses a brute force attack detection method and system, and equipment. The method comprises the following steps: grouping to-be-processed network flow; respectively extracting flow features of each network session in each group to obtain a flow feature set of each group; calculating a discrete trend index of each flow feature in the flow feature set of each group, and comparing the discrete trend index with a preset discrete trend standard threshold value; and obtaining a brute force attack result of a to-be-processed network session according to a comparison result of the discrete trend index and the discrete trend index standard threshold. According to the invention, detection is carried out according to the flow features of the to-be-processed network flow without depending on the attack frequency and the number of ports, and brute force attack attack behaviors in the network flow can be effectively detected. The network session is taken as a detection sample unit, so that the method is more flexible and practical, and a brute force attack can be detected at the first time when the brute force attack occurs, thereby reducing the possibility of successful brute force attack.

Description

technical field [0001] The invention relates to the field of computer network security, in particular to a detection method, detection system and equipment for brute force cracking attacks. Background technique [0002] With the popularity of encrypted services and the improvement of security awareness, more and more encrypted services are used for communication on the Internet, and remote management of servers and terminals uses SSH and RDP encrypted transmissions. Encrypted transmission protocols such as SSH and RDP can protect the privacy and integrity of users' remote login passwords and prevent them from being eavesdropped or tampered with. However, it also brings challenges to the detection of attack behavior through encrypted protocols. For plaintext communication, the attack behavior is easy to detect and defend; but for the attack behavior in the encrypted channel, it is difficult for existing security devices to detect and identify. [0003] Brute force cracking ...

AI Technical Summary

Problems solved by technology

Even if there are some methods to propose the detection technology of popular behavior characteristics, it is only applicable to the laboratory environment, failing to take into account the complexity of the real network environment, resulting in a low detection rate of brute-force cracking attacks and a high false positive rate in the real network environment

Images