A method, device and electronic device for preventing account explosion
By monitoring and counting the number of login failures of remote users in real time, network intercepting the target user's IP address when the preset threshold is reached, the problem that the existing technology cannot defend against horizontal blasting in the intranet is solved, and timely defense of remote blasting behavior is achieved , improves network security.
Patent Information
- Application Number
- CN202210738149.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-06-27
- Publication Date
- 2024-12-17
- Estimated Expiration
- 2042-06-27
AI Technical Summary
Existing firewall devices cannot effectively defend against intranet horizontal blasting without passing through the firewall, resulting in threats to network information security.
By monitoring the login failure events of remote users on the target device in real time, counting the number of login failures, and network intercepting the target user's IP address when the preset threshold is reached, and using a preset strategy to intercept to prevent account explosion.
It realizes timely and automatic defense of remote blasting accounts on internal and external networks, effectively monitors and intercepts malicious attackers, and improves network security.
Smart Images
Figure CN115189930B_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of computer application technology, and in particular relates to a method, device and electronic equipment for preventing account explosion. Background Art
[0002] Cyber Security refers to the protection of the hardware, software and data in the network system, which will not be damaged, altered or leaked due to accidental or malicious reasons, and the continuous and reliable operation of the system and uninterrupted network services. With the increasing amount of data shared by online users, cyber security has received more and more attention, and various network security manufacturers have developed a large number of security software and hardware products, such as anti-virus software, intrusion detection, database auditing, network gates, etc., to ensure the security of the network.
[0003] However, network users often use weak passwords due to lack of security awareness or for convenience. Malicious attackers can use tools to automatically and quickly crack passwords (such as enumeration + dictionary method), which brings serious security risks to network information security. In order to solve the problem of user account password cracking, network security companies often deploy firewalls and other border network defense devices for traffic detection and interception of password cracking. However, these existing solutions to prevent account cracking are powerless against lateral cracking of the intranet without passing through the firewall. Summary of the invention
[0004] In view of this, the embodiments of the present invention provide a method, device and electronic device for preventing account blasting, which are used to solve the problem that the existing solution for preventing account blasting cannot defend against the lateral blasting behavior of the intranet without passing through the firewall. The present invention can timely and automatically intercept the malicious attacker through the network after monitoring the remote user's failed login event to the target device account, thereby effectively solving the defense problem of remote blasting of accounts through the internal and external networks.
[0005] In a first aspect, an embodiment of the present invention provides a method for preventing account explosion, including:
[0006] Real-time monitoring of remote users' failed login events to target devices;
[0007] When a remote user fails to log in to a target device for the first time, the current time is determined as the initial time.
[0008] Starting from the initial moment, counting the number of login failures of the target user corresponding to the first login failure event;
[0009] Determine whether the number of login failures of the target user reaches a preset threshold. If so, use a preset strategy to perform network interception on the IP address of the target user.
[0010] In combination with the first aspect, in a first implementation of the first aspect, real-time monitoring of a remote user's failed login event to a target device includes:
[0011] Monitor the remote user's failed login events to the target device in real time through the target device's login log.
[0012] In combination with the first aspect, in a second implementation of the first aspect, the preset threshold includes a first preset threshold;
[0013] The counting of the number of login failures of the target user corresponding to the first login failure event starting from the initial moment includes:
[0014] Starting from the initial moment, at the expiration of each preset period, counting the number of login failures of the target user in the currently expired preset period;
[0015] The determining whether the number of login failures of the target user reaches a preset threshold includes:
[0016] Determine whether the number of login failures of the target user within the currently expired preset period has reached a first preset threshold;
[0017] If the number of login failures of the target user within the currently expired preset period reaches a first preset threshold, the step of using a preset strategy to perform network interception on the IP address of the target user is executed.
[0018] In combination with the second implementation of the first aspect, in a third implementation of the first aspect, the preset threshold further includes a second preset threshold; the second preset threshold is greater than the first preset threshold;
[0019] The counting of the number of login failures of the target user corresponding to the first login failure event starting from the initial moment also includes:
[0020] Starting from the initial moment, real-time statistics are collected on the total number of login failures of the target user;
[0021] The determining whether the number of login failures of the target user reaches a preset threshold also includes:
[0022] If the number of login failures of the target user within the currently expired preset period does not reach the first preset threshold, then before the next preset period expires, it is determined in real time whether the total number of login failures of the target user at the current moment reaches the second preset threshold;
[0023] If the total number of login failures of the target user at the current moment reaches the second preset threshold before the next preset period expires, the step of using the preset strategy to perform network interception on the IP address of the target user is executed;
[0024] If the total number of login failures of the target user does not reach the second preset threshold when the next preset period expires, the process returns to the step of determining whether the total number of login failures of the target user within the currently expired preset period reaches the first preset threshold.
[0025] In combination with the third implementation of the first aspect, in a fourth implementation of the first aspect, the adopting a preset strategy to perform network interception on the IP address of the target user includes:
[0026] If it is determined that the number of login failures of the target user within the currently expired preset period reaches a first preset threshold, a first preset strategy is used to perform network interception on the IP address of the target user;
[0027] If it is determined that the total number of login failures of the target user at the current moment reaches a second preset threshold before the next preset period expires, a second preset strategy is used to perform network interception on the IP address of the target user;
[0028] Among them, the first preset strategy is: issuing a blasting warning to the target device, and intercepting the IP address of the target user on the network according to the first duration / permanently; the second strategy is: issuing a suspected blasting warning to the target device, and intercepting the IP address of the target user on the network according to the second duration; the blasting warning includes at least the IP address of the target user intercepted this time, and the suspected blasting warning includes at least the IP address of the target user intercepted this time, and the first duration is greater than the second duration.
[0029] In combination with any one of the first to fourth implementations of the first aspect, in a fifth implementation of the first aspect, after the IP address of the target user is intercepted by a preset strategy, the method further includes:
[0030] Receive whitelist entry request;
[0031] Add the IP address specified in the whitelist entry request to the whitelist;
[0032] When the remote user fails to log in to the target device for the first time, before the current time is determined as the initial time, the following steps are also included:
[0033] Determine whether the IP address of the target user corresponding to the first login failure event is in the whitelist;
[0034] If the IP address of the target user corresponding to the first login failure event is in the whitelist, the process ends and the login failure event of the target user is no longer monitored;
[0035] If the IP address of the target user corresponding to the first login failure event is not in the whitelist, continue to execute the step of determining the current time as the initial time.
[0036] In a second aspect, an embodiment of the present invention provides a device for preventing account explosion, including:
[0037] Login monitoring module, used to monitor remote users' failed login events to target devices in real time;
[0038] An initial time determination module is used to determine the current time as the initial time when monitoring a remote user's first login failure event to the target device;
[0039] A counting module, used for counting the number of login failures of the target user corresponding to the first login failure event starting from the initial moment;
[0040] The judgment and interception module is used to judge whether the number of login failures of the target user reaches a preset threshold. If so, a preset strategy is used to perform network interception on the IP address of the target user.
[0041] In combination with the second aspect, in a first implementation of the second aspect, the login monitoring module is specifically used to monitor in real time the remote user's failed login events to the target device through the login log of the target device.
[0042] In combination with the second aspect, in a second implementation of the second aspect, the preset threshold includes a first preset threshold;
[0043] The counting module comprises:
[0044] A first counting unit, configured to count the number of login failures of the target user in the currently expired preset period starting from the initial moment and at the expiration of each preset period;
[0045] The judgment and interception module includes:
[0046] A first judging unit, configured to judge whether the number of login failures of the target user within the currently expired preset period obtained by the first counting unit reaches a first preset threshold;
[0047] The interception unit is used to adopt a preset strategy to perform network interception on the IP address of the target user when the judgment result of the first judgment unit is yes.
[0048] In combination with the second implementation of the second aspect, in a third implementation of the second aspect, the preset threshold further includes a second preset threshold; the second preset threshold is greater than the first preset threshold;
[0049] The counting module further includes:
[0050] A second counting unit, used for counting the total number of login failures of the target user in real time starting from the initial moment;
[0051] The judgment and interception module also includes:
[0052] A second judgment unit is used to judge in real time whether the total number of login failures of the target user at the current moment reaches a second preset threshold before the next preset period expires when the judgment result of the first judgment unit is no;
[0053] The interception unit is further configured to, when the judgment result of the second judgment unit is yes, perform network interception on the IP address of the target user using a preset strategy;
[0054] The first judgment unit is further configured to, when the judgment result of the second judgment unit is no, continue to judge whether the number of login failures of the target user within the currently expired preset period obtained by the first counting unit reaches a first preset threshold.
[0055] In combination with the third implementation of the second aspect, in a fourth implementation of the second aspect, the interception unit is specifically used to, when the judgment result of the first judgment unit is yes, use a first preset strategy to perform network interception on the IP address of the target user; or used to, when the judgment result of the second judgment unit is yes, use a second preset strategy to perform network interception on the IP address of the target user;
[0056] Among them, the first preset strategy is: issuing a blasting warning to the target device, and intercepting the IP address of the target user on the network according to the first duration / permanently; the second strategy is: issuing a suspected blasting warning to the target device, and intercepting the IP address of the target user on the network according to the second duration; the blasting warning includes at least the IP address of the target user intercepted this time, and the suspected blasting warning includes at least the IP address of the target user intercepted this time, and the first duration is greater than the second duration.
[0057] In combination with any one of the first to fourth implementations of the second aspect, in a fifth implementation of the second aspect, the device further includes:
[0058] A whitelist receiving module, used to receive a whitelist entry request;
[0059] A whitelist entry module, used to add the IP address specified by the whitelist entry request to the whitelist;
[0060] A whitelist determination module, used to determine whether the IP address of the target user corresponding to the first login failure event is in the whitelist;
[0061] The address processing module is used to trigger the login monitoring module to stop monitoring the target user's login failure event when the result of the whitelist judgment module's judgment is yes; it is also used to trigger the initial time determination module to determine the current time as the initial time when the result of the whitelist judgment module's judgment is no.
[0062] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: a housing, a processor, a memory, a circuit board and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the housing, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method for preventing account explosion described in any of the aforementioned embodiments.
[0063] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method for preventing account explosion as described in any of the aforementioned embodiments.
[0064] The present invention provides a method, device and electronic device for preventing account blasting. When the remote user's first login failure event to the target device is monitored in real time, the number of login failures of the target user corresponding to the first login failure event is counted, and when the number of failures reaches a preset threshold, the target user is intercepted on the network. The present invention can timely and automatically intercept the malicious attacker on the network after monitoring that the malicious attacker may blast the target device account, and can effectively monitor and intercept the behavior of remote blasting system accounts on the internal and external networks. BRIEF DESCRIPTION OF THE DRAWINGS
[0065] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0066] Figure 1A flow chart of a method for preventing account blasting provided by an embodiment of the present invention;
[0067] Figure 2 A flow chart of a second embodiment of a method for preventing account blasting provided by an embodiment of the present invention;
[0068] Figure 3 A flowchart of a third embodiment of a method for preventing account blasting provided by an embodiment of the present invention;
[0069] Figure 4 A flowchart of a fourth embodiment of a method for preventing account blasting provided by an embodiment of the present invention;
[0070] Figure 5 A schematic diagram of the structure of a first embodiment of a device for preventing account explosion provided by an embodiment of the present invention;
[0071] Figure 6 A schematic diagram of the structure of a second embodiment of a device for preventing account explosion provided by an embodiment of the present invention;
[0072] Figure 7 A schematic diagram of the structure of a third embodiment of a device for preventing account explosion provided by an embodiment of the present invention;
[0073] Figure 8 A schematic diagram of the structure of a fourth embodiment of a device for preventing account explosion provided by an embodiment of the present invention;
[0074] Fig. 9 The present invention provides a schematic structural diagram of an electronic device. DETAILED DESCRIPTION
[0075] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.
[0076] It should be clear that the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0077] Figure 1 A flowchart of a method for preventing account blasting provided by an embodiment of the present invention. Figure 1 The method comprises the following steps S101-S105:
[0078] S101: Real-time monitoring of remote users' failed login events to target devices.
[0079] In this embodiment, the login log of the target device can be used to monitor in real time the remote user's failed login events to the target device. The login log of the target device can be generated by the log monitoring system of the target device operating system (such as Windows), and can record in detail the time of the remote login, the IP address of the remote login user, the result of the remote login (failure or success) and other information, so that monitoring the remote login failure event has the advantages of convenient and accurate implementation.
[0080] S102: When an event of a remote user failing to log in to a target device for the first time is monitored, the current time is determined as an initial time.
[0081] S103: Starting from the initial moment, counting the number of login failures of the target user corresponding to the first login failure event.
[0082] In this embodiment, the behavior of remotely logging into the blasting account, because the malicious attacker does not know the account and password information of the target device, will use an enumeration method to continuously try possible accounts and passwords to remotely log into the target device, and then count the number of failed logins of the target user, which can objectively reflect whether the target user is a malicious attacker.
[0083] S104: Determine whether the number of login failures of the target user reaches a preset threshold, and then execute step S105.
[0084] S105: Using a preset strategy to perform network interception on the IP address of the target user.
[0085] In this embodiment, the IP address is a unified address format provided by the IP protocol. It assigns a logical address to each network and each host on the Internet. The access between devices across network segments is routed by this IP address. Therefore, by intercepting the IP address of the target user, the remote login behavior of the target user corresponding to the IP address can be prohibited. In the intranet environment, network security personnel can also bind the MAC address of the device to the IP address, thereby preventing malicious attackers from maliciously attacking the target device by constantly modifying the IP address, and correspondingly effectively improving the utilization rate of resources.
[0086] A method for preventing account blasting provided by an embodiment of the present invention starts to count the number of login failures of the target user corresponding to the first login failure event when real-time monitoring is detected for the first login failure event of a remote user to a target device, and performs network interception on the target user when the number of failures reaches a preset threshold. The present invention can timely and automatically perform network interception on the malicious attacker after monitoring that the malicious attacker may blast the target device account, and can effectively monitor and intercept the behavior of remotely blasting system accounts on the internal and external networks.
[0087] Figure 2 A flowchart of a second embodiment of a method for preventing account blasting provided by an embodiment of the present invention. Figure 2 The method comprises the following steps S201-S205:
[0088] S201: Real-time monitoring of remote users' failed login events to the target device.
[0089] S202: When an event of a remote user failing to log in to a target device for the first time is monitored, the current time is determined as an initial time.
[0090] S203: Starting from the initial moment, at the expiration of each preset period, the number of login failures of the target user corresponding to the first login failure event within the currently expired preset period is counted.
[0091] In this embodiment, the preset period is a set value, such as 3 seconds, and the initial time is recorded as 0, then the 3rd, 6th, ..., 3*X seconds are all the expiration time of a preset period (X is a positive integer), and then the number of remote login failures within each 3 seconds from the initial time can be counted, so as to judge whether the target device has been cracked by the account according to the number of login failures.
[0092] S204: Determine whether the number of login failures of the target user within the currently expired preset period reaches a first preset threshold; if yes, execute S205; otherwise, return to execute S203.
[0093] In this embodiment, the first preset threshold is also a set value, such as 5 times. If the remote login failure of the target device is: more than 5 failures within 3 seconds, the target user is judged to be a malicious attacker, and the IP address of the target user can be subsequently intercepted by network, thereby ensuring the security of the target device.
[0094] S205: Using a preset strategy to perform network interception on the IP address of the target user.
[0095] A method for preventing account blasting provided by an embodiment of the present invention monitors in real time the first failed login event of a remote user to a target device, and then starts to count the total number of failed logins of the target user corresponding to the first failed login event in each preset period, and when the number of failed logins in a preset period reaches a first preset threshold, firstly, the target user is determined to be a malicious attacker, and the target user is further intercepted on the network to protect the target device account; secondly, the process of counting the number of failed logins of the target user in each preset period is exited, thereby effectively improving the efficiency of system resource utilization.
[0096] Figure 3 A flowchart of a method for preventing account blasting provided by an embodiment of the present invention. Figure 3 The method comprises the following steps S301-S309:
[0097] S301: Monitor in real time the remote user's failed login events to the target device.
[0098] S302: When an event of a remote user failing to log in to a target device for the first time is monitored, the current time is determined as an initial time.
[0099] S303: Starting from the initial moment, the total number of login failures of the target user corresponding to the first login failure event is counted in real time, and when each preset period expires, the number of login failures of the target user in the currently expired preset period is counted.
[0100] This step is executed from the initial moment, that is, the total number of login failures of the target user corresponding to the first login failure event is counted in real time, and when each preset period expires, the number of login failures of the target user in the currently expired preset period is counted until the method of this embodiment executes S305 or S307 and ends the process.
[0101] S304: Determine whether the number of login failures of the target user within the currently expired preset period reaches a first preset threshold; if yes, execute S305; otherwise, execute S306.
[0102] In this embodiment, when a preset period expires, it is determined whether the number of login failures of the target user within the currently expired preset period reaches a first preset threshold. If so, S305 is executed and the process ends. Otherwise, S306 is continued.
[0103] S305: Adopting a first preset strategy to perform network interception on the IP address of the target user.
[0104] The first preset strategy is to issue a blasting warning to the target device and perform network interception on the IP address of the target user for a first duration / permanently, and the blasting warning includes at least the IP address of the target user intercepted this time.
[0105] S306: Before the next preset period expires, determine in real time whether the total number of login failures of the target user at the current moment reaches a second preset threshold, if yes, execute S307, otherwise execute S308.
[0106] The second preset threshold is greater than the first preset threshold.
[0107] In this embodiment, if the number of login failures of the target user in the last expired preset period reaches the first preset threshold, then before the next preset period expires, it is determined whether the total number of login failures of the target user at the current moment counted in real time in S303 reaches the second preset threshold. If so, execute S307 and end the process; otherwise, continue to execute S308.
[0108] S307: Adopting a second preset strategy to perform network interception on the IP address of the target user.
[0109] Among them, the second strategy is: to issue a suspected blasting warning to the target device, and to perform network interception on the IP address of the target user according to a second duration; the suspected blasting warning includes at least the IP address of the target user intercepted this time, and the first duration is greater than the second duration.
[0110] S308: Determine whether the preset period has expired, if so, return to execute S303, otherwise, return to execute S306.
[0111] In this embodiment, when the first failed login event of a remote user to a target device is monitored, the current time is determined as the initial time. Starting from the initial time, an end time can also be set. When the end time is reached, the number of failed logins of the target user corresponding to the first failed login event is stopped, and a check is made to see whether there is any target user who has successfully logged into the target device between the initial time and the end time. If so, a warning is issued to the target device that a suspected malicious attacker has successfully logged in, so as to facilitate the next step of response.
[0112] The present embodiment provides a method for preventing account blasting. When the remote user fails to log in to the target device for the first time in real time, the method starts to count the number of failed logins of the target user corresponding to the failed login event for the first time in each preset period, and counts the total number of failed logins of the target user from the first failed login to the current moment in real time; then, when the preset period expires, it is first determined whether the number of failed logins in the preset period reaches the first preset threshold, and if so, the first preset strategy is used to intercept the IP address of the target user on the network; when the first preset threshold is not reached, it continues to determine in real time whether the total number of failed logins exceeds the second preset threshold, and if so, the second preset strategy is used to intercept the IP address of the target user on the network. The present invention can determine whether the target user is a suspected malicious attacker or a malicious attacker in real time according to the number of failed logins of the target user, and then adopt different strategies to intercept the IP address of the target user on the network, thereby improving the accuracy of network interception, and while ensuring the security of the account, it also tries not to affect the normal operation of the legitimate user.
[0113] Furthermore, to solve Figure 2 and Figure 3 In the method shown, if the number of login failures of the target user in each preset period has not reached the first preset threshold or the total number of login failures of the target user in a long period of time has not reached the second preset threshold, resulting in repeated counting and judgment of login failures of the target user, preferably, Figure 3 In the method shown, step S306 may specifically include the following steps S3061-S3062:
[0114] S3061: Before the next preset period expires, determine whether the interval between the current moment and the initial moment reaches the preset deadline; if so, execute S3062, otherwise, end the process.
[0115] S3062: Determine whether the total number of login failures of the target user at the current moment reaches a second preset threshold, if yes, execute S307, otherwise execute S308.
[0116] In this embodiment, by setting a preset deadline, a maximum deadline can be set for the statistical process of S303, so as to avoid the situation where the statistical and judgment process is meaninglessly extended or the statistical results of a longer period of time have little reference value. For example, if the preset deadline is not set, it is possible that when it is determined that the total number of login failures of the target user reaches the second preset threshold, 5 days have passed since the initial time, and then this statistical result has no reference value.
[0117] In a preferred embodiment, the method provided by the present invention, especially in Figure 3 On the basis of the third embodiment of the method shown, S306 specifically includes: before the next preset period expires, it is determined in real time whether the target user's successful login event is monitored at the current moment or whether the total number of consecutive login failures of the target user reaches the second preset threshold, if yes, then S307 is executed, otherwise S308 is executed. In this embodiment, after the target user's successful login is monitored, a suspected blasting warning is immediately issued to warn the target device user to perform security operations such as viewing, further improving the safety rate of preventing account blasting.
[0118] Figure 4 A flowchart of a fourth embodiment of a method for preventing account blasting provided by an embodiment of the present invention. Figure 4 The method comprises the following steps S401-S408:
[0119] S401: Real-time monitoring of remote users' failed login events to the target device.
[0120] S402: Determine whether the IP address of the target user corresponding to the first login failure event is in the whitelist; if yes, end the process, otherwise execute S403.
[0121] S403: When an event of a remote user failing to log in to the target device for the first time is monitored, the current time is determined as the initial time.
[0122] S404: Starting from the initial moment, counting the number of login failures of the target user corresponding to the first login failure event;
[0123] S405: Determine whether the number of login failures of the target user reaches a preset threshold, if yes, execute step S406;
[0124] In this embodiment, the specific implementation method of S405 may be similar to the above steps S203-S204, or similar to the above steps S303-S308, and will not be repeated here.
[0125] S406: Using a preset strategy to perform network interception on the IP address of the target user.
[0126] S407: receiving a whitelist entry request;
[0127] S408: Add the IP address specified by the whitelist entry request to the whitelist.
[0128] A method for preventing account blasting provided by an embodiment of the present invention monitors in real time the first login failure event of a remote user to a target device, first determines whether the remote user is in the whitelist, if so, it means that the legitimate user accidentally inputs the wrong account information, and the number of failures of the remote login user is no longer monitored, otherwise, the number of login failures of the target user corresponding to the first login failure event is counted, and when the number of failures reaches a preset threshold, the target user is intercepted on the network. The present invention can accurately identify legitimate users and malicious attackers, not only can it save system resources during execution, but it can also timely and automatically intercept malicious attackers on the network, and can effectively monitor and intercept the behavior of remote blasting system accounts on internal and external networks.
[0129] Figure 5 A schematic diagram of a first embodiment of a device for preventing account explosion provided by an embodiment of the present invention. Figure 5 As shown, the device comprises:
[0130] The login monitoring module 1 is used to monitor the remote user's failed login events to the target device in real time. Preferably, the login monitoring module 1 is specifically used to monitor the remote user's failed login events to the target device in real time through the login log of the target device.
[0131] The initial time determination module 2 is used to determine the current time as the initial time when the login monitoring module 1 monitors the remote user's first failed login event to the target device.
[0132] The counting module 3 is used to count the number of login failures of the target user corresponding to the first login failure event starting from the initial moment.
[0133] The judgment and interception module 4 is used to judge whether the number of login failures of the target user reaches a preset threshold. If so, a preset strategy is used to perform network interception on the IP address of the target user.
[0134] The device of this embodiment can be used to perform Figure 1 The technical solution of the method embodiment shown has similar implementation principles and technical effects, which will not be repeated here.
[0135] Figure 6 This is a schematic diagram of the structure of a second embodiment of a device for preventing account explosion provided by an embodiment of the present invention. Figure 6 As shown, the device of this embodiment is Figure 5 Based on the device structure shown, further, the preset threshold includes a first preset threshold;
[0136] Counting module 3, comprising:
[0137] The first counting unit 31 is used for counting the number of login failures of the target user in the currently expired preset period starting from the initial moment when each preset period expires.
[0138] The judgment and interception module 4 includes:
[0139] The first judging unit 41 is used to judge whether the number of login failures of the target user within the currently expired preset period obtained by the first counting unit 31 reaches a first preset threshold;
[0140] The interception unit 42 is used to adopt a preset strategy to perform network interception on the IP address of the target user when the judgment result of the first judgment unit 41 is yes.
[0141] The device of this embodiment can be used to perform Figure 2 The technical solution of the method embodiment shown has similar implementation principles and technical effects, which will not be repeated here.
[0142] Figure 7 This is a schematic diagram of the structure of a third embodiment of a device for preventing account explosion provided by an embodiment of the present invention. Figure 7 As shown, the device of this embodiment is Figure 6 Based on the device structure shown, the preset threshold also includes a second preset threshold; the second preset threshold is greater than the first preset threshold;
[0143] The counting module 3 further includes:
[0144] A second counting unit 32 is used to count the total number of login failures of the target user in real time starting from the initial moment;
[0145] The judgment and interception module 4 also includes:
[0146] The second judgment unit 43 is used to judge in real time whether the total number of login failures of the target user at the current moment reaches a second preset threshold before the next preset period expires when the judgment result of the first judgment unit 41 is no;
[0147] The interception unit 42 is also used to, when the judgment result of the second judgment unit 43 is yes, adopt a preset strategy to perform network interception on the IP address of the target user; preferably, the interception unit 42 is specifically used to, when the judgment result of the first judgment unit 41 is yes, adopt a first preset strategy to perform network interception on the IP address of the target user; or used to, when the judgment result of the second judgment unit 43 is yes, adopt a second preset strategy to perform network interception on the IP address of the target user; wherein, the first preset strategy is: issuing a blasting warning to the target device, and performing network interception on the IP address of the target user according to a first duration / permanently; the second strategy is: issuing a suspected blasting warning to the target device, and performing network interception on the IP address of the target user according to a second duration; the blasting warning includes at least the IP address of the target user intercepted this time, and the suspected blasting warning includes at least the IP address of the target user intercepted this time, and the first duration is greater than the second duration.
[0148] The first judgment unit 41 is further configured to, when the judgment result of the second judgment unit 43 is no, continue to judge whether the number of login failures of the target user within the currently expired preset period obtained by the first counting unit 31 reaches a first preset threshold.
[0149] The device of this embodiment can be used to perform Figure 3 The technical solution of the method embodiment shown has similar implementation principles and technical effects, which will not be repeated here.
[0150] Figure 8 This is a schematic diagram of the structure of a fourth embodiment of a device for preventing account explosion provided by an embodiment of the present invention. Figure 8 As shown, the device of this embodiment is Figure 5 Based on the device structure shown, further, the device also includes:
[0151] Whitelist receiving module 7, used to receive a whitelist entry request;
[0152] A whitelist entry module 8, used to add the IP address specified by the whitelist entry request to the whitelist;
[0153] A whitelist determination module 5, used to determine whether the IP address of the target user corresponding to the first login failure event is in the whitelist 9;
[0154] The address processing module 6 is used to trigger the login monitoring module 1 to stop monitoring the target user's login failure event when the result of the judgment of the whitelist judgment module 5 is yes; it is also used to trigger the initial time determination module 2 to determine the current time as the initial time when the result of the judgment of the whitelist judgment module 5 is no.
[0155] The device of this embodiment can be used to perform Figure 4 The technical solution of the method embodiment shown has similar implementation principles and technical effects, which will not be repeated here.
[0156] An embodiment of the present invention further provides an electronic device. Fig. 9 A schematic diagram of the structure of an electronic device provided by the present invention can realize the present invention Figure 1 or Figure 2 The process of the embodiment shown is as follows: Fig. 9 As shown, the electronic device may include: a housing 21, a processor 22, a memory 23, a circuit board 24 and a power supply circuit 25, wherein the circuit board 24 is arranged inside the space enclosed by the housing 21, and the processor 22 and the memory 23 are arranged on the circuit board 24; the power supply circuit 25 is used to supply power to various circuits or devices of the electronic device; the memory 23 is used to store executable program codes; the processor 22 runs a program corresponding to the executable program code by reading the executable program code stored in the memory 23, so as to execute a method for preventing account explosion described in any of the aforementioned embodiments.
[0157] This electronic device exists in many forms, including but not limited to:
[0158] (1) Mobile communication devices: These devices are characterized by having mobile communication functions and their main purpose is to provide voice and data communications. These terminals include: smart phones (such as iPhone), multimedia phones, functional phones, and low-end phones.
[0159] (2) Ultra-mobile personal computer devices: These devices fall into the category of personal computers, have computing and processing capabilities, and generally also have mobile Internet access features. These terminals include: PDA, MID and UMPC devices, such as iPad.
[0160] (3) Portable entertainment devices: These devices can display and play multimedia content. They include audio and video playback modules (such as iPods), handheld game consoles, e-books, smart toys, and portable car navigation devices.
[0161] (4) Server: A device that provides computing services. The server consists of a processor, hard disk, memory, system bus, etc. The server is similar to a general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.
[0162] (5) Other electronic devices with data interaction functions.
[0163] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement any one of the methods for preventing account explosion provided in the aforementioned embodiments, thereby also achieving the corresponding technical effects, which have been described in detail above and will not be repeated here.
[0164] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.
[0165] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.
[0166] For the convenience of description, the above device is described by dividing the functions into various units / modules. Of course, when implementing the present invention, the functions of each unit / module can be implemented in the same or multiple software and / or hardware.
[0167] A person skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.
[0168] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.
Claims
1. A method for preventing account blasting, characterized in that: include: Real-time monitoring of remote users' failed login events to target devices; When a remote user fails to log in to a target device for the first time, the current time is determined as the initial time. Starting from the initial moment, counting the number of login failures of the target user corresponding to the first login failure event; Determine whether the number of login failures of the target user reaches a preset threshold, and if so, use a preset strategy to perform network interception on the IP address of the target user; The preset threshold comprises a first preset threshold; The counting of the number of login failures of the target user corresponding to the first login failure event starting from the initial moment includes: starting from the initial moment, at the expiration of each preset period, counting the number of login failures of the target user in the currently expired preset period; The determining whether the number of login failures of the target user reaches a preset threshold comprises: determining whether the number of login failures of the target user within a currently expired preset period reaches a first preset threshold; If the number of login failures of the target user within the currently expired preset period reaches a first preset threshold, the step of using a preset strategy to perform network interception on the IP address of the target user is executed; The preset threshold also includes a second preset threshold; the second preset threshold is greater than the first preset threshold; The counting of the number of login failures of the target user corresponding to the first login failure event starting from the initial moment also includes: Starting from the initial moment, real-time statistics are collected on the total number of login failures of the target user; The determining whether the number of login failures of the target user reaches a preset threshold also includes: If the number of login failures of the target user within the currently expired preset period does not reach the first preset threshold, then before the next preset period expires, it is determined in real time whether the total number of login failures of the target user at the current moment reaches the second preset threshold; If the total number of login failures of the target user at the current moment reaches the second preset threshold before the next preset period expires, the step of using the preset strategy to perform network interception on the IP address of the target user is executed; If the total number of login failures of the target user does not reach the second preset threshold when the next preset period expires, return to the step of determining whether the total number of login failures of the target user in the currently expired preset period reaches the first preset threshold; The adopting a preset strategy to perform network interception on the IP address of the target user includes: If it is determined that the number of login failures of the target user within the currently expired preset period reaches a first preset threshold, a first preset strategy is used to perform network interception on the IP address of the target user; If it is determined that the total number of login failures of the target user at the current moment reaches a second preset threshold before the next preset period expires, the second preset strategy is used to perform network interception on the IP address of the target user; Among them, the first preset strategy is: issuing a blasting warning to the target device, and intercepting the IP address of the target user on the network according to the first duration / permanently; the second preset strategy is: issuing a suspected blasting warning to the target device, and intercepting the IP address of the target user on the network according to the second duration; the blasting warning includes at least the IP address of the target user intercepted this time, and the suspected blasting warning includes at least the IP address of the target user intercepted this time, and the first duration is greater than the second duration.
2. A method for preventing account explosion as claimed in claim 1, characterized in that: The real-time monitoring of the remote user's failed login event to the target device includes: Monitor the remote user's failed login events to the target device in real time through the target device's login log.
3. A method for preventing account explosion according to any one of claims 1 to 2, characterized in that: After the preset strategy is used to perform network interception on the IP address of the target user, the method further includes: Receive whitelist entry request; Add the IP address specified in the whitelist entry request to the whitelist; When the remote user fails to log in to the target device for the first time, before the current time is determined as the initial time, the following steps are also included: Determine whether the IP address of the target user corresponding to the first login failure event is in the whitelist; If the IP address of the target user corresponding to the first login failure event is in the whitelist, the process ends and the login failure event of the target user is no longer monitored; If the IP address of the target user corresponding to the first login failure event is not in the whitelist, continue to execute the step of determining the current time as the initial time.
4. A device for preventing account explosion, characterized in that: include: Login monitoring module, used to monitor remote users' failed login events to target devices in real time; The initial time determination module is used to determine the current time as the initial time when monitoring the remote user's first login failure event to the target device; A counting module, used for counting the number of login failures of the target user corresponding to the first login failure event starting from the initial moment; A judgment and interception module is used to judge whether the number of login failures of the target user reaches a preset threshold. If so, a preset strategy is used to perform network interception on the IP address of the target user; The preset threshold comprises a first preset threshold; Wherein, the counting module comprises: A first counting unit, configured to count the number of login failures of the target user in the currently expired preset period starting from the initial moment and at the expiration of each preset period; The judgment and interception module includes: A first judging unit, configured to judge whether the number of login failures of the target user within the currently expired preset period obtained by the first counting unit reaches a first preset threshold; An interception unit, configured to, when the judgment result of the first judgment unit is yes, perform network interception on the IP address of the target user using a preset strategy; The preset threshold also includes a second preset threshold; the second preset threshold is greater than the first preset threshold; The counting module further includes: A second counting unit, used for counting the total number of login failures of the target user in real time starting from the initial moment; The judgment and interception module also includes: A second judgment unit is used to judge in real time whether the total number of login failures of the target user at the current moment reaches a second preset threshold before the next preset period expires when the judgment result of the first judgment unit is no; The interception unit is further configured to, when the judgment result of the second judgment unit is yes, perform network interception on the IP address of the target user using a preset strategy; The first judgment unit is further configured to, when the judgment result of the second judgment unit is negative, continue to judge whether the number of login failures of the target user within the currently expired preset period obtained by the first counting unit reaches a first preset threshold; The interception unit is specifically used to use a first preset strategy to perform network interception on the IP address of the target user when the judgment result of the first judgment unit is yes; or used to use a second preset strategy to perform network interception on the IP address of the target user when the judgment result of the second judgment unit is yes; Among them, the first preset strategy is: issuing a blasting warning to the target device, and intercepting the IP address of the target user on the network according to the first duration / permanently; the second preset strategy is: issuing a suspected blasting warning to the target device, and intercepting the IP address of the target user on the network according to the second duration; the blasting warning includes at least the IP address of the target user intercepted this time, and the suspected blasting warning includes at least the IP address of the target user intercepted this time, and the first duration is greater than the second duration.
5. The device for preventing account explosion as claimed in claim 4, characterized in that: The login monitoring module is specifically used to monitor the remote user's failed login events to the target device in real time through the login log of the target device.
6. The device for preventing account explosion as claimed in any one of claims 4 and 5, characterized in that: Also includes: A whitelist receiving module, used to receive a whitelist entry request; A whitelist entry module, used to add the IP address specified by the whitelist entry request to the whitelist; A whitelist determination module, used to determine whether the IP address of the target user corresponding to the first login failure event is in the whitelist; An address processing module, used for triggering the login monitoring module to stop monitoring the login failure event of the target user when the result of the judgment by the whitelist judgment module is yes; It is also used to trigger the initial time determination module to determine the current time as the initial time when the result of the judgment by the whitelist judgment module is no.
7. An electronic device, characterized in that: The electronic device comprises: a housing, a processor, a memory, a circuit board and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the housing, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program codes; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method for preventing account explosion described in any one of claims 1 to 3.
8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method for preventing account explosion according to any one of claims 1 to 3.