Attack behavior detection method and related equipment

Abstract

The present application discloses an attack behavior detection method, including: when a login behavior is monitored, the login information corresponding to the login behavior is collected and obtained, and the login information includes login indicators of multiple dimensions; the weights corresponding to each of the login indicators are accumulated to obtain an initial weight; the initial weights corresponding to each of the login behaviors within a preset time period are statistically obtained to obtain a total weight value; when the total weight value reaches a preset threshold, it is determined that a brute force attack behavior exists. The application of the technical solution provided by the present application can effectively improve the detection efficiency of brute force attack behaviors and the accuracy of detection results, and can also avoid the problem of lag in detection results. The present application also discloses an attack behavior detection device, an electronic device, and a computer-readable storage medium, which also have the above-mentioned technical effects.

Description

Technical Field

[0001] The present application relates to the field of computer security technology, and in particular to an attack behavior detection method, device, electronic device and computer-readable storage medium. Background Art

[0002] As computers and networks become more popular, security becomes more important. Brute force is an older attack method that is still effective and popular among hackers. It involves using a trial-and-error method to try to crack login information such as usernames or passwords.

[0003] At present, there are many methods to detect brute force attacks, such as: counting account / password login times, counting IP blacklist / whitelist latitude login behaviors, analyzing network traffic, analyzing network quintuples, etc. However, these methods all need to analyze system login logs or network traffic information within a certain period of time, and determine whether there is a brute force attack through analysis. Obviously, these implementation methods all have the following problems: when the logs or network traffic to be analyzed are large, the detection efficiency is low and the false alarm rate is high; and the analysis of a large amount of data takes a lot of time, resulting in a lag in the detection results.

[0004] Therefore, how to effectively improve the detection efficiency of brute force attack behaviors and the accuracy of detection results while avoiding the lag problem in detection results is an urgent problem to be solved by those skilled in the art. Summary of the invention

[0005] The purpose of the present application is to provide an attack behavior detection method, which can effectively improve the detection efficiency of brute force attack behavior and the accuracy of detection results, and can also avoid the problem of lag in detection results; another purpose of the present application is to provide an attack behavior detection device, electronic device and computer-readable storage medium, all of which have the above-mentioned beneficial effects.

[0006] In a first aspect, the present application provides an attack behavior detection method, comprising:

[0007] When a login behavior is detected, login information corresponding to the login behavior is collected and obtained, and the login information includes login indicators of multiple dimensions;

[0008] Accumulate the weights corresponding to the login indicators to obtain an initial weight;

[0009] Statistically obtain the initial weights corresponding to the login behaviors within a preset time period, and obtain the total weight value;

[0010] When the total weight value reaches a preset threshold, it is determined that a brute force attack behavior exists.

[0011] Optionally, the login indicators include login IP, login account, login port, login time, and login result.

[0012] Optionally, the accumulating weights corresponding to the login indicators to obtain an initial weight includes:

[0013] When the login indicator is a trustworthy indicator, obtaining a weight corresponding to the trustworthy indicator in a trustworthy weight list;

[0014] When the login indicator is an untrustworthy indicator, obtaining a weight corresponding to the untrustworthy indicator in an untrustworthy weight list;

[0015] The weights corresponding to the login indicators are accumulated to obtain the initial weights.

[0016] Optionally, determining whether the login indicator is the trustworthy indicator includes:

[0017] Determine whether the login indicator hits the corresponding trusted indicator list;

[0018] If so, determining that the login indicator is the trustworthy indicator;

[0019] If not, it is determined that the login indicator is the untrustworthy indicator.

[0020] Optionally, the attack behavior detection method further includes:

[0021] When there is a login behavior with a successful login result within the preset time period, each login indicator corresponding to the login behavior is added to the corresponding trustworthy indicator list.

[0022] Optionally, when the total weight value reaches a preset threshold, after determining that a brute force attack behavior exists, the method further includes:

[0023] Obtaining the final login result of the preset time period;

[0024] The attack result of the brute force attack behavior is determined according to the final login result.

[0025] Optionally, the attack behavior detection method further includes:

[0026] When the attack result is that the attack is successful, an alarm message is output.

[0027] In a second aspect, the present application further discloses an attack behavior detection device, comprising:

[0028] A collection module, used for collecting and obtaining login information corresponding to a login behavior when a login behavior is monitored, wherein the login information includes login indicators of multiple dimensions;

[0029] An accumulation module, used for accumulating the weights corresponding to the login indicators to obtain an initial weight;

[0030] A statistical module, used to obtain the initial weight corresponding to each login behavior within a preset time period and obtain the total weight value;

[0031] The determination module is used to determine the presence of a brute force attack when the total weight value reaches a preset threshold.

[0032] In a third aspect, the present application further discloses an electronic device, comprising:

[0033] Memory for storing computer programs;

[0034] A processor is used to implement the steps of any one of the attack behavior detection methods described above when executing the computer program.

[0035] In a fourth aspect, the present application further discloses a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of any one of the attack behavior detection methods described above are implemented.

[0036] The present application provides an attack behavior detection method, including: when a login behavior is monitored, collecting and obtaining login information corresponding to the login behavior, the login information including login indicators of multiple dimensions; accumulating the weights corresponding to each of the login indicators to obtain an initial weight; statistically obtaining the initial weights corresponding to each of the login behaviors within a preset time period to obtain a total weight value; when the total weight value reaches a preset threshold, determining that a brute force attack behavior exists.

[0037] By applying the technical solution provided in the present application, weight values ​​corresponding to different login indicators in the login information corresponding to the login behavior are created in advance, and then the login behavior is monitored in real time, and the weight is calculated according to the login information corresponding to the login behavior. Finally, the total weight of the login behavior occurring within a preset time period is counted, and based on the value of the total weight, it is determined whether there is a brute force attack behavior at present, thereby realizing the detection of brute force attack behavior. Obviously, this implementation method does not require data analysis of a large amount of log data or network traffic within a certain period of time, which effectively improves the detection efficiency of brute force attack behavior and the accuracy of the detection results, and can also avoid the problem of lag in the detection results.

[0038] The attack behavior detection device, electronic device, and computer-readable storage medium provided in this application all have the above-mentioned beneficial effects, which will not be described in detail here. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the prior art and the embodiments of the present application, the drawings required for use in the description of the prior art and the embodiments of the present application are briefly introduced below. Of course, the drawings described below in relation to the embodiments of the present application are only part of the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without creative work, and the obtained other drawings also belong to the protection scope of the present application.

[0040] Figure 1 A flowchart of an attack behavior detection method provided in this application;

[0041] Figure 2 A schematic diagram of the structure of an attack behavior detection device provided in this application;

[0042] Figure 3 A schematic diagram of the structure of an electronic device provided in this application. DETAILED DESCRIPTION

[0043] The core of the present application is to provide an attack behavior detection method, which can effectively improve the detection efficiency of brute force attack behavior and the accuracy of detection results, and can also avoid the problem of lag in detection results; another core of the present application is to provide an attack behavior detection device, electronic device and computer-readable storage medium, all of which have the above-mentioned beneficial effects.

[0044] In order to describe the technical solutions in the embodiments of the present application more clearly and completely, the technical solutions in the embodiments of the present application will be introduced below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0045] An embodiment of the present application provides an attack behavior detection method.

[0046] Please refer to Figure 1 , Figure 1 This is a flow chart of an attack behavior detection method provided in the present application. The attack behavior detection method may include the following S101 to S104.

[0047] S101: When a login behavior is detected, login information corresponding to the login behavior is collected and obtained, where the login information includes login indicators in multiple dimensions;

[0048] This step aims to monitor login behavior and collect login information corresponding to login behavior. For any application software in a computer network, users need to log in before performing various application operations. Based on this, in order to detect brute force attack behaviors, real-time login behavior monitoring of the target application software can be performed. Once the login behavior of the target application software is detected, the login information corresponding to the login behavior can be collected at the same time. Among them, the target login software is the application software that needs to be detected for attack behavior.

[0049] Among them, login information refers to various types of information related to the current login behavior, which may include login indicators of multiple dimensions. In a possible implementation method, the login indicator may include login IP (IP information of the login user), login account (account information of the login user), login port (port information used by the target application software), login time (time point of the current login behavior), and login result (login failure or login success). It can be understood that when a user logs in to the target application software, there is usually a fixed login account, login IP, login port and login time period, and brute force attack behavior generally attempts to use different accounts, IPs, ports and is mostly blasted in the early morning time period. Therefore, the detection of brute force attack behavior can be realized from the five dimensions of login account, login IP, login port, login time period and number of login failures. Furthermore, an information filter can be set before the login module of the application software, and then when the login behavior is monitored, the login information can be filtered based on the information filter, and the login information is used for subsequent data analysis to realize attack behavior detection.

[0050] S102: Accumulate the weights corresponding to the login indicators to obtain an initial weight;

[0051] This step aims to realize the weight calculation of the current login behavior. Specifically, for each type of login indicator, the corresponding weight value can be pre-set, that is, one login indicator corresponds to one weight value. Thus, after collecting the login information, the weight value corresponding to each login indicator can be determined, and these weight values ​​can be accumulated to obtain the weight value corresponding to the current login behavior, that is, the above-mentioned initial weight. It should be noted that the mapping relationship between the login indicator and the weight value can be set by the technician according to the actual situation. Different login indicators can correspond to the same weight value or different weight values, and this application does not limit this.

[0052] S103: Obtaining statistics of initial weights corresponding to various login behaviors within a preset time period, and obtaining a total weight value;

[0053] This step is intended to achieve weight calculation within a preset time period. It is understandable that the detection of attack behavior based only on the information statistics of a single login behavior may have a relatively low accuracy. Based on this, login information statistics can be collected for multiple login behaviors within a specified time period, and the total weight value can be calculated. Attack behavior detection can be achieved based on the calculation result, which can greatly improve the accuracy of the detection result.

[0054] In the implementation process, after obtaining the initial weight corresponding to a login behavior, the login behavior monitoring can continue. When a new login behavior is monitored again, it can be determined whether the time difference between the time point of the new login behavior and the time point of the last login behavior exceeds the above-mentioned preset time period. If it does not exceed the preset time period, the initial weight corresponding to the new login behavior can be calculated, and then added to the initial weight corresponding to the last login behavior to obtain the total weight value, and so on, until the preset time period is reached. In other words, the initial weights corresponding to all login behaviors occurring within the preset time period are added and calculated to obtain the total weight value within the preset time period, thereby realizing attack behavior detection based on the total weight value.

[0055] It should be noted that the specific value of the above-mentioned preset time period does not affect the implementation of the present technical solution, and can be set by technical personnel according to actual conditions. This application does not limit this. For example, in an embodiment of the present application, the preset time period can be set to one minute.

[0056] S104: When the total weight value reaches a preset threshold, it is determined that a brute force attack behavior exists.

[0057] This step aims to detect attack behaviors based on the total weight value within a preset time period. Specifically, after calculating the total weight value within the preset time period, it can be compared with the preset threshold. If the total weight value exceeds the preset threshold, it can be determined that the current login behavior has a brute force attack; conversely, if the total weight value does not exceed the preset threshold, it can be determined that the current login behavior does not have a brute force attack.

[0058] Of course, the specific value of the preset threshold does not affect the implementation of the present technical solution, and can be set by technical personnel according to actual conditions. This application does not limit this. For example, in an embodiment of the present application, the preset threshold can be set to 100.

[0059] In addition, when the total weight value does not exceed the preset threshold and it is determined that the current login behavior does not involve profiteering cracking behavior, the total weight value can be further set to zero to start a new round of attack behavior detection, that is, entering the next cycle (a preset time period is a cycle) of attack behavior detection.

[0060] It can be seen that the attack behavior detection method provided in the embodiment of the present application pre-creates weight values ​​corresponding to different login indicators in the login information corresponding to the login behavior, and then monitors the login behavior in real time, and calculates the weight according to the login information corresponding to the login behavior. Finally, the total weight of the login behavior occurring within a preset time period is counted, and the total weight is determined based on the value of the weight to determine whether there is a brute force attack behavior at present, thereby realizing the detection of brute force attack behavior. Obviously, this implementation method does not require data analysis of a large amount of log data or network traffic within a certain period of time, which effectively improves the detection efficiency of brute force attack behavior and the accuracy of the detection results, and can also avoid the problem of lag in the detection results.

[0061] In one embodiment of the present application, the above-mentioned accumulation of weights corresponding to the login indicators to obtain the initial weights may include the following steps:

[0062] When the login indicator is a trusted indicator, obtain the corresponding weight of the trusted indicator in the trusted weight list;

[0063] When the login indicator is an untrusted indicator, obtain the weight corresponding to the untrusted indicator in the untrusted weight list;

[0064] The weights corresponding to each login indicator are accumulated to obtain the initial weight.

[0065] The embodiment of the present application provides a method for calculating the initial weight corresponding to a single login behavior. As described above, weight values ​​corresponding to different login indicators can be created in advance to facilitate the calculation of the initial weight corresponding to the current login behavior. On this basis, in order to further improve the accuracy of attack detection behavior, different weight values ​​can be set according to the trustworthiness of the login indicator, that is, for the same login indicator, different weight values ​​can be set according to its trustworthiness.

[0066] Specifically, after obtaining the login information corresponding to a login behavior, that is, after obtaining the various login indicators corresponding to a login behavior, you can first judge the credibility of each login indicator. If the login indicator is a trustworthy indicator, you can obtain its weight set in the trusted weight list; if the login indicator is an untrustworthy indicator, you can obtain its weight in the untrustworthy weight list, and so on. After obtaining the weight corresponding to each login indicator, accumulate the weight values ​​to obtain the initial weight corresponding to the current login row.

[0067] In one embodiment of the present application, determining whether a login indicator is a trustworthy indicator may include the following steps:

[0068] Determine whether the login indicator hits the corresponding trusted indicator list;

[0069] If so, the login indicator is determined to be a trustworthy indicator;

[0070] If not, the login indicator is determined to be an untrustworthy indicator.

[0071] The embodiment of the present application provides an implementation method for determining whether a login indicator is a trustworthy indicator. Specifically, for each type of login indicator, a trustworthy indicator list can be created in advance to store the trustworthy login indicators of this type. Therefore, after obtaining the login indicator, it can be determined whether the login indicator hits its corresponding trustworthy indicator list. If it hits, it can be determined that the login indicator is a trustworthy indicator. Otherwise, it can be determined as an untrustworthy indicator. Taking the login IP as an example, it can be determined whether the login IP hits the trusted IP list. If so, it can be determined that the login IP is a trustworthy login IP. Otherwise, it can be determined as an untrustworthy login IP. Further, for other login IPs, the same similar method can be used to implement trustworthiness judgment.

[0072] In one embodiment of the present application, the attack behavior detection method may further include the following steps:

[0073] When there is a login behavior with a successful login result within the preset time period, each login indicator corresponding to the login behavior is added to the corresponding trustworthy indicator list.

[0074] The attack behavior detection method provided in the embodiment of the present application can further realize the update of the trusted indicator list. Specifically, for the login behavior whose login result is a successful login within the preset time period, it means that the login behavior is a legal behavior, that is, the logged-in user is a legal user. At this time, the various login indicators corresponding to the login behavior can be added to the corresponding trusted indicator list, thereby realizing the update of the trusted indicator list. It can be imagined that by updating the trusted indicator list, the comprehensiveness of the legal login indicators in the trusted indicator list can be effectively improved, providing accuracy guarantee for subsequent new attack behavior detection.

[0075] In one embodiment of the present application, when the total weight value reaches a preset threshold, after determining that a brute force attack behavior exists, the following steps may also be included:

[0076] Get the final login result for the preset time period;

[0077] Determine the attack result of the brute force attack based on the final login result.

[0078] The attack behavior detection method provided in the embodiment of the present application can further realize the determination of the attack result, where the attack result refers to whether the brute force attack behavior existing in the current login behavior is successful. Specifically, when the total weight value reaches the preset threshold value and it is determined that there is a brute force attack behavior currently, the final login result within the preset time period can be further obtained, that is, to determine whether the logged-in user finally logs in successfully after the preset time period ends. Since it has been determined that there is indeed a brute force attack behavior currently, if the final login result is a successful login, it means that the attack result of this brute force attack behavior is a successful attack; conversely, if the final login result is a failed login, it means that the attack result of this brute force attack behavior is a failed attack. Furthermore, the attack results of successful attacks and failed attacks can be counted separately.

[0079] In one embodiment of the present application, the attack behavior detection method may further include the following steps:

[0080] When the attack result is successful, an alarm message is output.

[0081] The attack behavior detection method provided in the embodiment of the present application can further realize the alarm function. Specifically, after obtaining the attack result, if the attack result is a successful attack, that is, when the brute force attack behavior existing in the current login behavior is successful, an alarm message can be further output to remind the technician that the current application software is being attacked by brute force and the attack has been successful, so that the technician can perform alarm maintenance in time.

[0082] Among them, the implementation method of outputting alarm information is not unique, and an alarm reminder can be implemented. For example, it can be an indicator light alarm, a horn alarm, or a remote alarm such as SMS notification, email notification, etc. This application does not limit this.

[0083] Based on the above embodiments, the embodiment of the present application provides another attack behavior detection method.

[0084] In the embodiment of the present application, brute force attack behavior detection is implemented based on five dimensions: login account, login IP, login port, login time period, and number of login failures. First, for the detection items in these five dimensions, a trusted weight list (Table 1) and an untrusted weight list (Table 2) are created as follows:

[0085] Table 1 Trust weight list

[0086]

[0087] Table 2 Untrustworthy weight list

[0088]

[0089] On this basis, the implementation process of the attack behavior detection method can include:

[0090] Step 1. Add a filter in front of the original login module. When a login behavior is monitored, the login account, login IP, login port, current login time and login success or failure flag are obtained in real time; determine whether the time difference between this login and the last login exceeds 1 minute (preset time period). If it exceeds 1 minute, reset the total weight to 0, that is, numTotal = 0 (wherein, the time difference of 1 minute is configurable, and the total weight of 100 is also configurable. The embodiment of the present application adopts within 1 minute. If the total weight is greater than 100, it is judged as a brute force attack behavior. When the time difference between the two logins is greater than 1 minute, the total weight numTotal is reset to 0).

[0091] Step 2: Check whether the login IP in step 1 exists in the trusted IP list:

[0092] (1) If the login IP does not exist in the trusted IP list, then the weights of the account, IP, port, and login time period of this login are added according to the weight of the untrusted zone: 5+3+2+1=11, and then the login weight is added to the total weight, that is, numTotal=numTotal+11, and the total weight numTotal is determined to be greater than 100:

[0093] a. When it is greater than 100, it proves that it is a brute force cracking behavior, and then judges whether the login is successful. If the login is successful, then record a brute force cracking behavior success; if the login fails, then record a brute force cracking behavior failure;

[0094] b. When it is less than 100, determine whether the local login is successful. If the login is successful, update the IP address of this login to the trusted IP list, and update the account, port, login time, etc. of this login to the corresponding trusted account list, trusted port list and trusted login time list; if the login fails, then numTotal = numTotal + 2 (that is, add the weight of the failed login 2), and then determine whether numTotal is greater than 100. If it is greater than 100, it proves to be a brute force cracking behavior, and records a brute force cracking behavior failure, otherwise it is not a brute force cracking behavior.

[0095] (2) If the login IP exists in the trusted IP list, then the account, port, and login time period are determined in turn based on the trusted IP to determine whether they are in the corresponding trusted account list, trusted port list, and trusted login time list to obtain the trust or non-trust weight value, and then the weight values ​​of the current login account, IP, port, and login time period are added together: account weight + (-3) IP weight + port weight + login time period weight = num, and then the current login weight is added to the weight sum, that is, numTotal = numTotal + num, and determine whether the weight sum numTotal is greater than 100:

[0096] a. When it is greater than 100, it proves that it is a brute force cracking behavior, and then judges whether the login is successful. If the login is successful, then record a brute force cracking behavior success; if the login fails, then record a brute force cracking behavior failure;

[0097] b. When it is less than 100, determine whether the local login is successful. If the login is successful, update the account, port, login time, etc. of this login to the corresponding trusted account list, trusted port list and trusted login time list; if the login fails, then numTotal = numTotal + 2 (that is, add the weight of the failed login 2), and then determine whether numTotal is greater than 100 again. If it is greater than 100, it proves to be a brute force cracking behavior, and records a brute force cracking behavior failure, otherwise it is not a brute force cracking behavior.

[0098] Step 3: When continuous login behavior is detected, step 1 and step 2 are executed repeatedly to determine whether brute force cracking behavior occurs.

[0099] It can be seen that the attack behavior detection method provided in the embodiment of the present application pre-creates weight values ​​corresponding to different login indicators in the login information corresponding to the login behavior, and then monitors the login behavior in real time, and calculates the weight according to the login information corresponding to the login behavior. Finally, the total weight of the login behavior occurring within a preset time period is counted, and the total weight is determined based on the value of the weight to determine whether there is a brute force attack behavior at present, thereby realizing the detection of brute force attack behavior. Obviously, this implementation method does not require data analysis of a large amount of log data or network traffic within a certain period of time, which effectively improves the detection efficiency of brute force attack behavior and the accuracy of the detection results, and can also avoid the problem of lag in the detection results.

[0100] An embodiment of the present application provides an attack behavior detection device.

[0101] Please refer to Figure 2 , Figure 2This is a schematic diagram of the structure of an attack behavior detection device provided by the present application. The attack behavior detection device may include:

[0102] Collection module 1, used for collecting and obtaining login information corresponding to the login behavior when the login behavior is monitored, and the login information includes login indicators of multiple dimensions;

[0103] Accumulation module 2, used to accumulate the weights corresponding to each login indicator to obtain an initial weight;

[0104] Statistics module 3, used to obtain the initial weight corresponding to each login behavior within a preset time period and obtain the total weight value;

[0105] The determination module 4 is used to determine the presence of a brute force attack when the total weight value reaches a preset threshold.

[0106] It can be seen that the attack behavior detection device provided in the embodiment of the present application pre-creates weight values ​​corresponding to different login indicators in the login information corresponding to the login behavior, and then monitors the login behavior in real time, and calculates the weight according to the login information corresponding to the login behavior. Finally, the total weight of the login behavior occurring within a preset time period is counted, and the total weight is determined based on the value of the weight to determine whether there is a brute force attack behavior at present, thereby realizing the detection of brute force attack behavior. Obviously, this implementation method does not require data analysis of a large amount of log data or network traffic within a certain period of time, which effectively improves the detection efficiency of brute force attack behavior and the accuracy of the detection results, and can also avoid the problem of lag in the detection results.

[0107] In one embodiment of the present application, the above-mentioned login indicators may include login IP, login account, login port, login time, and login result.

[0108] In one embodiment of the present application, the accumulation module 2 may include:

[0109] A first acquisition unit, configured to acquire a weight corresponding to the trusted indicator in a trusted weight list when the login indicator is a trusted indicator;

[0110] A second acquisition unit is used to acquire a weight corresponding to the untrusted indicator in the untrusted weight list when the login indicator is an untrusted indicator;

[0111] The accumulation unit is used to accumulate the weights corresponding to each login indicator to obtain an initial weight.

[0112] In one embodiment of the present application, the above-mentioned accumulation module 2 may also include a judgment unit for judging whether the login indicator hits the corresponding trusted indicator list; if so, the login indicator is determined to be a trusted indicator; if not, the login indicator is determined to be an untrustworthy indicator.

[0113] In one embodiment of the present application, the accumulation module 2 may further include an updating unit for adding login indicators corresponding to the login behavior to corresponding trustworthy indicator lists when there is a login behavior with a successful login result within a preset time period.

[0114] In one embodiment of the present application, the attack behavior detection device may also include a determination module for obtaining the final login result of a preset time period after determining that a brute force attack behavior exists when the total weight value reaches a preset threshold; and determining the attack result of the brute force attack behavior based on the final login result.

[0115] In one embodiment of the present application, the attack behavior detection device may further include an alarm module, which is used to output alarm information when the attack result is a successful attack.

[0116] For an introduction to the device provided in the embodiments of the present application, please refer to the above method embodiments, and the present application will not elaborate on them here.

[0117] An embodiment of the present application provides an electronic device.

[0118] Please refer to Figure 3 , Figure 3 This is a schematic diagram of the structure of an electronic device provided in this application, and the electronic device may include:

[0119] Memory for storing computer programs;

[0120] The processor is used to implement the steps of any one of the above-mentioned attack behavior detection methods when executing a computer program.

[0121] like Figure 3 , which is a schematic diagram of the composition structure of an electronic device, the electronic device may include: a processor 10, a memory 11, a communication interface 12 and a communication bus 13. The processor 10, the memory 11 and the communication interface 12 all communicate with each other through the communication bus 13.

[0122] In the embodiment of the present application, the processor 10 may be a central processing unit (CPU), an application specific integrated circuit, a digital signal processor, a field programmable gate array or other programmable logic devices, etc.

[0123] The processor 10 may call a program stored in the memory 11. Specifically, the processor 10 may execute operations in the embodiment of the attack behavior detection method.

[0124] The memory 11 is used to store one or more programs, which may include program codes, and the program codes include computer operation instructions. In the embodiment of the present application, the memory 11 at least stores programs for implementing the following functions:

[0125] When a login behavior is detected, the login information corresponding to the login behavior is collected and obtained, and the login information includes login indicators in multiple dimensions;

[0126] Accumulate the weights corresponding to each login indicator to obtain the initial weight;

[0127] Statistically obtain the initial weights corresponding to each login behavior within a preset time period and obtain the total weight value;

[0128] When the total weight value reaches the preset threshold, it is determined that a brute force attack has occurred.

[0129] In a possible implementation, the memory 11 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function, etc.; the data storage area may store data created during use.

[0130] In addition, the memory 11 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device or other volatile solid-state storage device.

[0131] The communication interface 12 may be an interface of a communication module, and is used to connect to other devices or systems.

[0132] Of course, it should be noted that Figure 3 The structure shown does not constitute a limitation on the electronic device in the embodiment of the present application. In actual applications, the electronic device may include Figure 3 More or fewer components than shown, or combinations of certain components.

[0133] An embodiment of the present application provides a computer-readable storage medium.

[0134] The computer-readable storage medium provided in the embodiment of the present application stores a computer program, and when the computer program is executed by a processor, the steps of any of the above-mentioned attack behavior detection methods can be implemented.

[0135] The computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0136] For an introduction to the computer-readable storage medium provided in the embodiments of the present application, please refer to the above method embodiments, and the present application will not elaborate on them here.

[0137] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0138] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0139] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0140] The technical solution provided by the present application is described in detail above. The principle and implementation method of the present application are described in detail using specific examples herein, and the description of the above embodiments is only used to help understand the method and core idea of ​​the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principle of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the present application.

Claims

1. A method for detecting attack behavior, characterized in that: include: When a login behavior is detected, at least the IP information of the login user corresponding to the login behavior, the account information of the login user, the port information used by the target application software for login, and the time point of the current login behavior are collected; wherein the target application software is the application software for which attack behavior detection is required; Determine the corresponding weight based on the IP information of the logged-in user, the account information of the logged-in user, the port information used by the target application software for logging in, and the trustworthiness of the time point of the current login behavior; The weights corresponding to the IP information of the logged-in user, the account information of the logged-in user, the port information used by the logged-in target application software, and the time point of the current login behavior are accumulated to obtain the initial weight; Statistically obtain the initial weights corresponding to the login behaviors within a preset time period, and obtain the total weight value; When the total weight value reaches a preset threshold, it is determined that a brute force attack behavior exists.

2. The attack behavior detection method according to claim 1, characterized in that: The login indicators corresponding to the login behavior also include a login port and a login result.

3. The attack behavior detection method according to claim 1, characterized in that: The weights corresponding to each login indicator are accumulated to obtain the initial weights, including: When the login indicator is a trustworthy indicator, obtaining a weight corresponding to the trustworthy indicator in a trustworthy weight list; When the login indicator is an untrustworthy indicator, obtaining a weight corresponding to the untrustworthy indicator in an untrustworthy weight list; The weights corresponding to the login indicators are accumulated to obtain the initial weights.

4. The attack behavior detection method according to claim 3, characterized in that: Determining whether the login indicator is the trustworthy indicator includes: Determine whether the login indicator hits the corresponding trusted indicator list; If so, determining that the login indicator is the trustworthy indicator; If not, it is determined that the login indicator is the untrustworthy indicator.

5. The attack behavior detection method according to claim 4, characterized in that: Also includes: When there is a login behavior with a successful login result within the preset time period, each login indicator corresponding to the login behavior is added to the corresponding trustworthy indicator list.

6. The attack behavior detection method according to claim 1, characterized in that: When the total weight value reaches a preset threshold, after determining that a brute force attack behavior exists, the method further includes: Obtaining the final login result of the preset time period; The attack result of the brute force attack behavior is determined according to the final login result.

7. The attack behavior detection method according to claim 6, characterized in that: Also includes: When the attack result is that the attack is successful, an alarm message is output.

8. An attack behavior detection device, characterized in that: include: The acquisition module is used to acquire at least the IP information of the login user corresponding to the login behavior, the account information of the login user, the port information used by the login target application software, and the time point of the current login behavior when the login behavior is monitored; wherein the target application software is the application software that needs to be detected for attack behavior; The accumulation module is used to determine the corresponding weight according to the IP information of the logged-in user, the account information of the logged-in user, the port information used by the logged-in target application software, and the trustworthiness of the time point of the current login behavior; the weights corresponding to the IP information of the logged-in user, the account information of the logged-in user, the port information used by the logged-in target application software, and the time point of the current login behavior are accumulated to obtain the initial weight; A statistical module, used to obtain the initial weight corresponding to each login behavior within a preset time period and obtain the total weight value; The determination module is used to determine the presence of a brute force attack when the total weight value reaches a preset threshold.

9. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the attack behavior detection method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the attack behavior detection method according to any one of claims 1 to 7 are implemented.

Images