Information processing method, device and storage medium

Abstract

The present invention provides an information processing method, device, and storage medium. The method comprises: obtaining a login log; if the login log meets predetermined conditions, searching a current network log library for a network log corresponding to the login log information; and determining login tag information for the login log based on the network log. Because this solution correlates the network log and login log to determine the login tag, it considers more comprehensive factors, thereby improving the accuracy of brute force login detection.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of network security technology, and in particular to an information processing method, device, and storage medium. Background Art

[0002] Currently, Windows brute force login detection is determined by reading Windows login logs. In related technologies, logs containing logontype == 3 are directly identified as Server Message Block (SMB) logins, while logs containing logontype == 10 are directly identified as Remote Desktop Protocol (RDP) logins. However, other Windows processes occasionally generate logs with logontype == 3 or logontype == 10, and sometimes RDP logins do not generate logs with logontype == 10, resulting in low accuracy in existing login detection methods. Summary of the Invention

[0003] An information processing method, device, and storage medium provided by embodiments of the present invention can improve the accuracy of brute force login determination.

[0004] The technical solution of the present invention is achieved as follows:

[0005] An embodiment of the present invention provides an information processing method, including:

[0006] Get login logs;

[0007] When the login log meets a predetermined condition, searching the current network log library for a network log corresponding to the login log information;

[0008] In combination with the network log, the login tag information of the login log is determined.

[0009] In the above solution, when the login log meets a predetermined condition, searching the current network log library for a network log corresponding to the login log includes:

[0010] When the login type character string in the login log is preset information and the login log contains address information, at least one corresponding network log is searched in the current network log library using the time information and the address information of the login log.

[0011] In the above solution, the step of determining the login tag information of the login log by combining the network log includes one of the following:

[0012] If the port information included in the at least one network log is the same, determining the login tag information based on the port information;

[0013] If the port information included in the at least one network log is not uniform, the login tag information is determined based on the log number information in the at least one network log.

[0014] In the above solution, the at least one network log includes: a first network log and a second network log; the first network log includes: first port information and first log number information; the second network log includes: second port information and second log number information;

[0015] The determining the login tag information based on the log number information in the at least one network log includes:

[0016] determining target log number information to which the acquired first random number belongs from the first log number information and the second log number information;

[0017] Determining target port information corresponding to the target log number information from the first port information and the second port information;

[0018] The login tag information is determined based on the target port information.

[0019] In the above solution, when the login log meets a predetermined condition, searching the current network log library for a network log corresponding to the login log includes:

[0020] When the login type character string in the login log is preset information and the login log does not contain address information, at least one corresponding network log is searched in the current network log library using the time information of the login log.

[0021] In the above solution, the step of determining the login tag information of the login log by combining the network log includes one of the following:

[0022] If the address information included in the at least one network log is the same, determining the login tag information based on the port information in the at least one network log;

[0023] If the respective address information included in the at least one network log is not uniform, determining the target address information from the respective address information based on the obtained second random number;

[0024] The login tag information is determined based on the target address information.

[0025] In the above solution, determining the login tag information based on the target address information includes:

[0026] Searching for at least one corresponding intermediate network log in the current network log library using the time information and the target address information;

[0027] The login tag information is determined based on the port information in the at least one intermediate network log.

[0028] In the above solution, the at least one network log includes: N network logs; the N network logs include: N log number information; N is an integer greater than 1;

[0029] The determining target address information from each address information based on the obtained second random number includes:

[0030] Determining the belonging log number information corresponding to the second random number from the N log number information;

[0031] The target address information included in the second network log to which the belonging log number information belongs is determined in the respective address information.

[0032] In the above solution, the step of determining the login tag information of the login log by combining the network log includes:

[0033] If the address information included in the at least one network log is not uniform, determining the target address information from the address information based on the proportion information of the address information;

[0034] Determining at least one third network log corresponding to the target address information in the at least one network log; the at least one third network log has the same time information;

[0035] The login tag information is determined based on the port information in the at least one third network log.

[0036] Obtaining network log data accessed by the attack host through the preset port information at each time node; wherein the predetermined time period includes multiple time nodes;

[0037] Based on the network log data, forming the network log corresponding to the same attack host at each time node to obtain multiple network logs;

[0038] The current network log library is formed by using the multiple network logs to update the network log library corresponding to the previous predetermined time period.

[0039] In the above solution, obtaining the network log data accessed by the attack host through the preset port information at each time node includes:

[0040] Acquire first network log data accessed by the attacking host through the first port information and second network log data accessed through the second port information at each time node.

[0041] In the above solution, the network log corresponding to the same attacking host at each time node is formed based on the network log data to obtain multiple network logs, including:

[0042] Determining first log number information based on the number of the first network log data, and then combining the address information of the same attacking host, the time information corresponding to each time node, and the first port information to form a first node network log;

[0043] Determine second log number information according to the number of the second network log data, and then combine the address information, the time information and the second port information to form a second node network log;

[0044] The multiple network logs are obtained by acquiring the first node network log and the second node network log corresponding to the same attacking host at each time node.

[0045] An embodiment of the present invention further provides an information processing device, including:

[0046] An information acquisition unit, used to acquire login logs;

[0047] A search unit, configured to search a current network log library for a network log corresponding to the login log information when the login log meets a predetermined condition;

[0048] The determining unit is configured to determine the login tag information of the login log in combination with the network log.

[0049] An embodiment of the present invention further provides an information processing device, including a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and the processor implements the steps in the above method when executing the program.

[0050] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which implements the steps in the above method when executed by a processor.

[0051] In this embodiment of the present invention, a login log is obtained; if the login log meets predetermined conditions, a network log corresponding to the login log information is searched in the current network log library; and login tag information for the login log is determined based on the network log. Because this solution associates the network log and login log to determine the login tag, it considers more comprehensive factors, thereby improving the accuracy of brute force login detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 A schematic diagram of an optional effect of the information processing method provided by an embodiment of the present invention;

[0053] Figure 2 A schematic diagram of an optional effect of the information processing method provided by an embodiment of the present invention;

[0054] Figure 3 An optional flowchart of the information processing method provided by an embodiment of the present invention;

[0055] Figure 4 An optional flowchart of the information processing method provided by an embodiment of the present invention;

[0056] Figure 5 An optional flowchart of the information processing method provided by an embodiment of the present invention;

[0057] Figure 6 An optional flowchart of the information processing method provided by an embodiment of the present invention;

[0058] Figure 7 An optional flowchart of the information processing method provided by an embodiment of the present invention;

[0059] Figure 8 An optional flowchart of the information processing method provided by an embodiment of the present invention;

[0060] Figure 9 An optional flowchart of the information processing method provided by an embodiment of the present invention;

[0061] Figure 10 An optional flowchart of the information processing method provided by an embodiment of the present invention;

[0062] Figure 11 An optional flowchart of the information processing method provided by an embodiment of the present invention;

[0063] Figure 12 A schematic diagram of an optional effect of the information processing method provided by an embodiment of the present invention;

[0064] Figure 13An optional flowchart of the information processing method provided by an embodiment of the present invention;

[0065] Figure 14 A schematic diagram of the structure of an information processing device provided by an embodiment of the present invention;

[0066] Figure 15 A schematic diagram of a hardware entity of an information processing device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0067] In order to make the purpose, technical solutions and advantages of the present invention clearer, the technical solutions of the present invention are further elaborated in detail below with reference to the accompanying drawings and embodiments. The described embodiments should not be regarded as limiting the present invention. All other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0068] In the following description, reference is made to “some embodiments”, which describes a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0069] If similar descriptions of "first / second" appear in the invention document, the following explanation is added. In the following description, the terms "first\second\third" involved are only used to distinguish similar objects and do not represent a specific order for the objects. It can be understood that "first\second\third" can be interchanged with the specific order or sequence where permitted, so that the embodiments of the invention described herein can be implemented in an order other than that illustrated or described herein.

[0070] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present invention pertains. The terms used herein are for the purpose of describing embodiments of the present invention only and are not intended to limit the present invention.

[0071] In the related art, the current brute force login of Windows is to directly read the Windows login log. For the log with logontype==3, it is directly judged as an SMB login failure. However, this method does not work. The official Microsoft document has a detailed description of the scenario of logontype==3: For example, the login of Structured Query Language (SQL) will also generate logon events, and even RPC calls will also generate logon events. For example, combined with Figure 1Net usage, Remote Procedure Call (RPC), Remote Registry, Internet Information Services (IIS) Integrated Windows Authentication, and SQL Windows Authentication all include logontype == 3. Therefore, it is unreasonable to determine SMB brute force logins based on logontype == 3.

[0072] The current Windows RDP brute force solution also captures the login log, taking the logontype 10 log. However, from the current performance, in the higher version of Windows, the RDP brute force event using Kali does not generate a log with Logontype 10, but instead generates a log with Logontype 3. And if the RDP security option is turned on, some logs will not have the IP and username. For example, combined with Figure 2 , for RDP brute force, only when logging in through the Windows remote interactive interface will a log with logontype 10 be generated. Instead, a log with logontype 3 will be generated.

[0073] The present invention provides an information processing method. Figure 3 , is an optional flow chart of the information processing method provided by the embodiment of the present invention, which is combined with Figure 3 The steps shown are explained.

[0074] S101. Obtain login log.

[0075] In the embodiment of the present invention, the terminal obtains a login log.

[0076] In the embodiment of the present invention, the terminal can find the login log from the log manager that comes with Windows and filter out other types of logs. The login log refers to the log with the event ID field as 4624 (login successful) or 4625 (login failed).

[0077] In the embodiment of the present invention, since the default login port of SMB is 445, the terminal needs to monitor the accept event of SMB port 445 and only obtain the log of the time when the event occurs to obtain the login log.

[0078] In the embodiment of the present invention, since the default login port of RDP is 3389, which is different from the default port of SMB, the RDP port can be changed. The terminal can read the RDP login port through the local registry. The terminal needs to monitor the accept event of the RDP port and only log the time when the event occurs to obtain the login log.

[0079] S102: When the login log meets a predetermined condition, search the current network log library for a network log corresponding to the login log information.

[0080] In the embodiment of the present invention, when a login log meets a predetermined condition, the terminal searches for a network log corresponding to the login log information in the current network log library.

[0081] In the embodiment of the present invention, when the login log includes the character string of Logontype==3, the terminal searches the current network log library for the network log corresponding to the login log information.

[0082] In the embodiment of the present invention, when the login log of the terminal includes the character string of Logontype==3, the terminal can search for the network log including the time information in the current network log library according to the time information of the login log.

[0083] In the embodiment of the present invention, when the terminal login log includes the string Logontype==3, the terminal can search the current network log library for the network log including the time information and address information of the login log according to the time information and address information of the login log.

[0084] In the embodiment of the present invention, if the terminal detects that the login log includes a character string of Logontype==10, the terminal may determine that the login tag information of the login log is an RDP login.

[0085] In an embodiment of the present invention, a current network log library includes multiple network logs, each of which includes corresponding time information, address information, port information, and log count information. A terminal can obtain network log data within a predetermined time period using a locally installed lightweight probe, and then extract multiple network logs from the network log data to form a current network log library, thereby updating the network log library corresponding to the previous predetermined time period.

[0086] In this embodiment of the present invention, the terminal requires a network connection monitoring module and maintains a connection table containing logs for ports 445 and 3389. When the terminal detects a connection log for ports 445 or 3389 within a predetermined time period, it records the connection IP address, port number, and timestamp to create a network log and stores it in the connection table. The connection table contains multiple tuples of network logs (timestamp, source_ip, local_port). The terminal is required to regularly clear timed-out network logs from the connection table.

[0087] For example, the terminal login log may be:

[0088]

[0089] The terminal can use the etw module on the agent to obtain the network log on the terminal and store it in the current network log library. The terminal only obtains the network log of port information 45 / rdp_port

[0090] For example, the terminal may search for a network log in the current network log library as follows:

[0091]

[0092] S103: Determine login tag information of the login log in combination with the network log.

[0093] In the embodiment of the present invention, the terminal determines the login tag information of the login log in combination with the network log.

[0094] In an embodiment of the present invention, if the terminal detects that the port information, address information, and time information in the network log are all the same, the terminal can determine the login tag information based on the port information in the network log. If the port information indicates an SMB login, the terminal can determine that the login tag is an SMB login; if the port information indicates an RDP login, the terminal can determine that the login tag is an RDP login. If the port information includes the "dstPort":rdp_port" field, the port information can be determined to indicate an RDP login; if the port information includes the "dstPort":445 field, the port information can be determined to indicate an SMB login.

[0095] In an embodiment of the present invention, if a terminal detects that the port information in a network log is inconsistent but the address information and time information are the same, the terminal can determine the port information with the largest corresponding log number information from the port information. If the port information indicates an SMB login, the terminal can determine that the login tag information is an SMB login; if the port information indicates an RDP login, the terminal can determine that the login tag information is an RDP login.

[0096] In an embodiment of the present invention, when a terminal detects that the port information and address information in a network log are inconsistent, the terminal determines the address information with the largest corresponding log number from the address information. The terminal then determines the login tag information based on the port information corresponding to the address information.

[0097] In this embodiment of the present invention, the terminal uses timestamp B to query the connection table for ports 445 and 3389 for each login log containing logontype == 3. If the connection table contains a network log with timestamp A∈[timestamp B-1s,timestamp B], the terminal retrieves all network logs that have not timed out for verification. Otherwise, the terminal determines that the login log is not associated with SMB or RDP logins and discards it.

[0098] In an embodiment of the present invention, if there is an IP field in the login log. If the src_port of all items in the retrieved network log is unique, the terminal can determine that the login log is an SMB or RDP login, and label the login log according to the src_port. If the src_port in the retrieved network log is both 445 and 3389, the terminal will randomly assign it according to the ratio of the login types. Because the ratio actually represents the frequency of the login type. It is the simplest random algorithm. For example, at this point in time in the login log, there are 100 SMB logins and 155 RDP logins. The terminal takes a random number and determines which interval the random number falls into. We then determine what kind of login this time is. For example, the random number can be 50. Since 50 belongs to the range of 0-100, and 0-100 belongs to SMB login, the terminal can determine that the login label information is an SMB login.

[0099] In the embodiment of the present invention, if there is no IP field in the login log and the IP in the retrieved network log is unique, the terminal determines the login tag information based on the port information in the network log at that time.

[0100] In this embodiment of the present invention, if the IP address in the retrieved network log is not unique, the terminal randomly assigns a unique IP address based on the IP distribution ratio. Specifically, the terminal extracts the address information corresponding to the maximum number of logs in the network log, and uses this address information and time information to extract a portion of the network log. The terminal then combines the port information of this portion of the network log to determine the login tag information.

[0101] In this embodiment of the present invention, a login log is obtained; if the login log meets predetermined conditions, a network log corresponding to the login log information is searched in the current network log library; and login tag information for the login log is determined based on the network log. Because this solution associates the network log and login log to determine the login tag, it considers more comprehensive factors, thereby improving the accuracy of brute force login detection.

[0102] In some embodiments, see Figure 4 , Figure 4 An optional flowchart of the information processing method provided by an embodiment of the present invention is shown. Figure 3S102 to S103 shown can also be implemented through S104 to S105, which will be explained in conjunction with each step.

[0103] S104: When the login type character string in the login log is preset information and the login log contains address information, use the time information and address information of the login log to find at least one corresponding network log in the current network log library.

[0104] In an embodiment of the present invention, when the login type string in the login log is preset information and the login log contains address information, the terminal uses the time information and address information of the login log to search for at least one corresponding network log in the current network log library. The address information is the address information of the attacking host.

[0105] In the embodiment of the present invention, when the terminal includes the string logontype==3 in the login log and the login log includes address information, at least one network log including the time information and address information of the login log is searched in the current network log library.

[0106] In this embodiment of the present invention, a terminal can obtain network logs through an agent. The agent is a lightweight probe installed on the terminal, and etw is the module on the agent that obtains network logs. Currently, RDP / SMB connections on mainstream Windows terminals are established via the Transmission Control Protocol (TCP) / Internet Protocol (IP), which inevitably generates network logs. The terminal needs to start a scheduled task on the agent to periodically obtain RDP / SMB port information.

[0107] The terminal can associate network logs and login logs through timestamps. For example, at 11:17:12, a host logged into a Windows terminal through the RDP protocol, but the login failed. The terminal can obtain the login log:

[0108] {

[0109] "time":"11:17:12",

[0110] "eventID":4625

[0111] "logontype":3,

[0112] "ipAddr":"192.168.1.1"

[0113] }

[0114] At this point, the terminal detects that the login log contains the string "logontype == 3." Based on the (ip, time) in the login log, the terminal searches the current network log database for a network log with ipAddr = 192.168.1.1 and a time range of "11:17:11" - "11:17:12." The terminal finds the network log {"time":"11:17:12","ipAddr":192.168.1.1,"dstPort":rdp_port,"count":1}.

[0115] S105: If the port information included in at least one network log is the same, determine the login tag information based on the port information.

[0116] In the embodiment of the present invention, if the port information included in at least one network log is the same, the terminal determines the login tag information based on the port information.

[0117] In an embodiment of the present invention, if the port information is "dstPort":rdp_port", the terminal can determine that the login tag information is RDP login; if the port information is "dstPort":445, the terminal can determine that the login tag information is SMB login.

[0118] For example, at least one network log contains the following information: {"time":"11:17:12","ipAddr":192.168.1.1,"dstPort":rdp_port,"count":1}. If the terminal detects the port information in the network log as "rdp_port," it determines that the login tag information is an RDP login. "count":1 is the log count, indicating that at 11:17:12, the attacking host 192.168.1.1 accessed the RDP port once.

[0119] In an embodiment of the present invention, when the terminal includes the string logontype==3 in the login log and the login log contains address information, at least one corresponding network log can be found. If the port information contained in the at least one network log is the same, the login tag information is determined based on the port information. Since this solution considers the network log in addition to the login log, the accuracy of the determined login tag information is improved.

[0120] In some embodiments, see Figure 5 , Figure 5 An optional flowchart of the information processing method provided by an embodiment of the present invention is shown. Figure 4 The illustrated S105 can also be implemented through S106 , which will be described in conjunction with each step.

[0121] S106: If the port information included in the at least one network log is not uniform, determining the login tag information based on the log number information in the at least one network log.

[0122] In an embodiment of the present invention, if the port information included in the at least one network log is not uniform, the terminal determines the login tag information based on the log number information in the at least one network log.

[0123] In the embodiment of the present invention, the terminal may determine the network log corresponding to the maximum log number information in at least one network log, and the terminal may determine the login tag information using the port information in the network log.

[0124] In some embodiments, see Figure 6 , Figure 6 An optional flowchart of the information processing method provided by an embodiment of the present invention is shown. Figure 5 The illustrated S106 can also be implemented through S107 to S109 , which will be described in conjunction with each step.

[0125] S107: If the port information included in the at least one network log is not uniform, determine the target log number information to which the obtained first random number belongs from the first log number information and the second log number information.

[0126] In an embodiment of the present invention, at least one network log includes: a first network log and a second network log; the first network log includes: first port information and first log count information; and the second network log includes: second port information and second log count information. If the port information included in the at least one network log is inconsistent, the terminal determines, from the first log count information and the second log count information, the target log count information to which the obtained first random number belongs.

[0127] In this embodiment of the present invention, the terminal searches for network logs with ipAddr = 192.168.1.1 and a time range of "11:17:11" - "11:17:12" using the (ip, time) in the login log. It finds two network logs: {"time":"11:17:12","ipAddr":192.168.1.1,"dstPort":rdp_port,"count":123} and {"time":"11:17:12","ipAddr":192.168.1.1,"dstPort":445,"count":231}. The terminal first generates a first random number A, ensuring that the first random number is less than 123 + 231. The terminal determines which log number information interval the first random number falls into. For example, if the first random number falls into the interval [0,123), the terminal determines the target log number information as 123.

[0128] S108: Determine target port information corresponding to the target log number information from the first port information and the second port information.

[0129] In the embodiment of the present invention, the terminal determines the target port information corresponding to the target log number information from the first port information and the second port information.

[0130] In the embodiment of the present invention, the terminal determines that the target log number information corresponds to the target port information “dstPort”:rdp_port.

[0131] S109: Determine login tag information based on the target port information.

[0132] In the embodiment of the present invention, the terminal determines the login tag information based on the target port information.

[0133] In the embodiment of the present invention, when the destination port information is "dstPort":rdp_port", it is determined that the login tag information is RDP login.

[0134] In the embodiment of the present invention, the terminal determines the target port information from the first port information and the second port information by using the first random number, so as to obtain login tag information with higher accuracy.

[0135] In some embodiments, see Figure 7 , Figure 7 An optional flowchart of the information processing method provided by an embodiment of the present invention is shown. Figure 3 S102 to S103 shown can also be implemented through S110 to S111 , which will be described in conjunction with each step.

[0136] S110 : When the login type character string in the login log is preset information and the login log does not contain address information, use the time information of the login log to search for at least one corresponding network log in the current network log library.

[0137] In the embodiment of the present invention, when the login type character string in the login log is preset information and the login log does not contain address information, the terminal uses the time information of the login log to find at least one corresponding network log in the current network log library.

[0138] In the embodiment of the present invention, when the terminal includes the string logontype==3 in the login log and the login log does not include address information, at least one network log including time information of the login log is searched in the current network log library.

[0139] S111 : If the address information contained in at least one network log is the same, determining login tag information based on the port information in at least one network log.

[0140] In the embodiment of the present invention, if the address information included in the at least one network log is the same, the terminal determines the login tag information based on the port information in the at least one network log.

[0141] In an embodiment of the present invention, if the address information and the port information included in at least one network log are the same, the terminal determines the login tag information using the port information.

[0142] In an embodiment of the present invention, if at least one network log contains the same address information but different port information, the terminal uses the port information to determine the login tag information. The terminal then uses the port information of the network log to determine the login tag information by taking a random number and determining which network log's log number range the random number falls within.

[0143] In an embodiment of the present invention, the terminal detects that the "ipAddr" field in the login log is an empty value. The terminal queries the current network log library based on the (time) search condition of the login log and finds at least one corresponding network log: {"time":"11:17:12","ipAddr":192.168.1.1,"dstPort":rdp_port,"count":1}. The terminal detects that the port information of the network log is "rdp_port", and determines that the login tag information of the login log is RDP login.

[0144] In an embodiment of the present invention, when the terminal includes the string logontype==3 in the login log and the login log does not contain address information, at least one corresponding network log can be found. When the address information of at least one network log is the same, more accurate login tag information can be determined based on its port information.

[0145] In some embodiments, see Figure 8 , Figure 8 An optional flowchart of the information processing method provided by an embodiment of the present invention is shown. Figure 7 The illustrated S111 can also be implemented through S112 to S113 , which will be described in conjunction with each step.

[0146] S112: If the address information included in at least one network log is not uniform, determine the target address information from the address information based on the obtained second random number.

[0147] In the embodiment of the present invention, if the various address information included in at least one network log is not uniform, the terminal determines the target address information from the various address information based on the obtained second random number.

[0148] In the embodiment of the present invention, if the address information included in at least one network log is not uniform, the terminal obtains a second random number and determines the target address information corresponding to the log number information to which the second random number belongs.

[0149] S113. Determine login tag information based on the target address information.

[0150] In the embodiment of the present invention, the terminal determines the login tag information based on the target address information.

[0151] In an embodiment of the present invention, the terminal searches for at least one corresponding intermediate network log in the current network log library based on the target address information and the time information of the login log, and then determines the login tag information based on whether the port information of the at least one intermediate network log is consistent.

[0152] In an embodiment of the present invention, when the terminal includes the string logontype==3 in the login log and the login log does not contain address information, the terminal can find at least one corresponding network log, and when the address information of at least one network log is inconsistent, the target address information is determined by the second random number, and the login tag information with higher accuracy can be determined based on the port information corresponding to the target address information.

[0153] In some embodiments, see Figure 9 , Figure 9 An optional flowchart of the information processing method provided by an embodiment of the present invention is shown. Figure 8 S112 to S113 shown can also be implemented through S114 to S117, which will be explained in conjunction with each step.

[0154] S114: If the address information included in at least one network log is not uniform, determine the belonging log number information corresponding to the second random number from the N log number information.

[0155] In an embodiment of the present invention, the at least one network log includes N network logs; the N network logs include N log number information; and N is an integer greater than 1. If the address information included in the at least one network log is not uniform, the terminal determines the attribution log number information corresponding to the second random number from the N log number information.

[0156] S115 . Determine, from each address information, target address information included in the second network log to which the attributed log number information belongs.

[0157] In the embodiment of the present invention, the terminal determines, from each piece of address information, target address information included in the second network log to which the belonging log number information belongs.

[0158] S116: Use the time information and the target address information to search for at least one corresponding intermediate network log in the current network log library.

[0159] In the embodiment of the present invention, the terminal uses the time information and the target address information to search for at least one corresponding intermediate network log in the current network log library.

[0160] In the embodiment of the present invention, the terminal searches the current network log library for at least one intermediate network log containing both time information and target address information.

[0161] S117: Determine login tag information based on the port information in at least one intermediate network log.

[0162] In the embodiment of the present invention, the terminal determines the login tag information based on the port information in at least one intermediate network log.

[0163] In an embodiment of the present invention, the at least one network log found by the terminal using the time information of the login log includes: {"time":"11:17:12","ipAddr":192.168.1.1,"dstPort":rdp_port,"count":123}, {"time":"11:17:12","ipAddr":192.168.1.2,"dstPort":445,"count":431} and {"time":"11:17:12","ipAddr":192.168.1.2,"dstPort":rdp_port,"count":231}. The terminal can obtain the second random number 200 and determine that the second random number belongs to the log number information count":231. Then, the terminal can determine that the target address information is "192.168.1.2". The terminal uses the target address information "192.168.1.2" and the time information "11:17:12" to find two intermediate network logs {"time":"11:17:12","ipAddr":192.168.1.2,"dstPort":445,"count":431} and {"time":"11:17:12"} in the current network log library. ":"11:17:12","ipAddr":192.168.1.2,"dstPort":rdp_port,"count":231}. The terminal determines that the port information of the two intermediate network logs is inconsistent, so the terminal obtains another random number 201 and determines that the random number 201 belongs to the log number information "count":231. The terminal then determines that the login tag information with higher accuracy is the RDP login based on the port information "dstPort":rdp_port" corresponding to the log number information "count":231.

[0164] In some embodiments, see Figure 10 , Figure 10 An optional flowchart of the information processing method provided by an embodiment of the present invention is shown. Figure 9 S114 to S117 shown can also be implemented through S118 to S120, which will be explained in conjunction with each step.

[0165] S118: If the address information included in at least one network log is not uniform, determine the target address information from the address information based on the proportion information of the address information.

[0166] In the embodiment of the present invention, if the address information included in at least one network log is not uniform, the terminal determines the target address information from the address information based on the proportion information of the address information.

[0167] In the embodiment of the present invention, if the various pieces of address information included in at least one network log are not uniform, the terminal may determine a piece of target address information having the largest proportion among the various pieces of address information.

[0168] S119: Determine at least one third network log corresponding to the target address information in the at least one network log.

[0169] In an embodiment of the present invention, the terminal determines at least one third network log corresponding to the target address information in the at least one network log, wherein the at least one third network log has the same time information.

[0170] In the embodiment of the present invention, the terminal determines at least one third network log from the at least one network log that contains the target log information and has the same time information.

[0171] S120: Determine login tag information based on port information in at least one third network log.

[0172] In the embodiment of the present invention, the terminal determines the login tag information based on the port information in at least one third network log.

[0173] In the embodiment of the present invention, the terminal determines the login tag information based on whether the port information in at least one third network log is consistent.

[0174] In this embodiment of the present invention, if the addresses contained in at least one network log are inconsistent, the target address is determined from the addresses based on their respective proportions. Because this solution not only considers the proportions of the addresses but also combines network logs with login logs, it can generate more accurate login tag information.

[0175] In some embodiments, see Figure 11 , Figure 11 An optional flowchart of an information processing method provided by an embodiment of the present invention will be described in conjunction with each step.

[0176] S121. Obtain network log data accessed by the attack host through the preset port information at each time node.

[0177] In an embodiment of the present invention, the terminal obtains network log data accessed by the attack host through preset port information at each time node, wherein the predetermined time period includes multiple time nodes.

[0178] In the embodiment of the present invention, the terminal obtains the first network log data accessed by the attack host through the first port information and the second network log data accessed through the second port information at each time node.

[0179] In this embodiment of the present invention, when any attacking host accesses a terminal through a preset port at any time, the terminal can obtain network log data including source port information, source IP information, local port information, local IP information, and timestamp through the agent's etw module. The address information of different attacking hosts is different, that is, the source IP information is different.

[0180] In the embodiment of the present invention, a same time node may include multiple attack hosts accessing the terminal through preset port information.

[0181] S122 : Based on the network log data, a network log corresponding to the same attacking host at each time node is generated to obtain multiple network logs.

[0182] In the embodiment of the present invention, the terminal forms a network log corresponding to the same attacking host at each time node based on the network log data to obtain multiple network logs.

[0183] In an embodiment of the present invention, a terminal determines first log count information based on the number of first network log data, and then combines the address information of the same attacking host, the time information corresponding to each time node, and the first port information to form a first node network log. A terminal determines second log count information based on the number of second network log data, and then combines the address information, time information, and second port information to form a second node network log. By obtaining the first node network log and the second node network log corresponding to the same attacking host at each time node, the terminal obtains multiple network logs.

[0184] For example, combined Figure 12 Each network log can include: time information, address information, port information, and log number information. The time information is the timestamp of the corresponding log data rounded down (can be rounded to the second level). The address information is the source IP information of the corresponding log data. The port information is the host port information of the corresponding log data (445 or 3389).

[0185] In this embodiment of the present invention, the terminal obtains the network log timestamp and rounds it down to the nearest second. It then searches for the timestamp in the current network log database. (Select count from connect_table where time = A, and src_ip = B and dst_port = C) If a log with the same timestamp and src_ip exists, the corresponding log in the current network log database is set to count + 1. If not, the log is inserted and count = 1.

[0186] S123: forming a current network log library through multiple network logs to update the network log library corresponding to the previous predetermined time period.

[0187] In the embodiment of the present invention, the terminal forms a current network log library through multiple network logs to update the network log library corresponding to the previous predetermined time period.

[0188] In this embodiment of the present invention, the terminal creates a new current network log library every 10 minutes. When a new current network log library is created, the previous current network log library is deleted. The new log is written to a new log database file. This is the cleanup mechanism.

[0189] In an embodiment of the present invention, the terminal obtains the network logs of each time node in a predetermined time period to form a current network log library. Since the current network log library is continuously updated, when the terminal searches for the corresponding network log through the current network log library, the found network log is more closely matched with the corresponding login log.

[0190] In some embodiments, see Figure 13 , Figure 13 An optional flowchart of an information processing method provided by an embodiment of the present invention will be described in conjunction with each step.

[0191] S201 and 445 port connection logs.

[0192] In the embodiment of the present invention, the terminal monitors the network log of port 445 through the network connection, extracts the connection IP, source port, and connection timestamp A to form a network log storage.

[0193] S202 and 3389 port connection logs.

[0194] In the embodiment of the present invention, the terminal monitors the network log of port 3389 through the network connection, extracts the connection IP, source port, and connection timestamp A to form a network log storage.

[0195] S203, RDP SMB connection table.

[0196] In the embodiment of the present invention, the terminal stores the network logs obtained through port 445 and port 3389 in the connection table.

[0197] S204, login log.

[0198] In the embodiment of the present invention, the terminal monitoring obtains a login log including the character string longontype==3.

[0199] S205: Whether there is a network log.

[0200] In the embodiment of the present invention, the terminal searches the connection table for a network log based on the time information of the login log. If the network log does not exist, S206 is executed and the process ends.

[0201] S207: Is there an IP address in the login log?

[0202] In the embodiment of the present invention, there is a network log of the login log in the connection table, and the terminal detects whether the login log has an IP.

[0203] S208: Whether the network log contains the IP address.

[0204] In the embodiment of the present invention, if the login log has an IP, the terminal detects whether the network log contains the IP. If the IP is contained, S210, obtain the network log of the unique IP.

[0205] S209: Is the IP in the network log unique?

[0206] In the embodiment of the present invention, if the login log does not contain the IP, the terminal detects whether the IP in the network log is unique.

[0207] S211. Check whether the login type in the network log is consistent.

[0208] In this embodiment of the present invention, if the IP address in the network log is unique, the terminal checks whether the login type in the network log is consistent. If so, S212 determines one of the network connection logs for the IP address. S215 reports the login log and tags it with the logonetype tag. If the IP address is not present, the IP tag is added.

[0209] S214. Randomly allocate in proportion.

[0210] In the embodiment of the present invention, if the login types in the network logs are inconsistent, the terminal randomly assigns a network log in proportion.

[0211] S213. Obtain network logs of a single IP address randomly according to a certain ratio.

[0212] In the embodiment of the present invention, if the IP in the network log is not unique, a network log of a single IP is randomly obtained in proportion, and then S212 is executed.

[0213] See also Figure 14 , Figure 14 A schematic diagram of the structure of an information processing device provided by an embodiment of the present invention.

[0214] The embodiment of the present invention further provides an information processing device 800 , comprising: an information acquiring unit 803 , a searching unit 804 , and a determining unit 805 .

[0215] Information acquisition unit 803, used to obtain login logs;

[0216] A search unit 804 is configured to search a current network log library for a network log corresponding to the login log information when the login log meets a predetermined condition;

[0217] The determining unit 805 is configured to determine the login tag information of the login log in combination with the network log.

[0218] In an embodiment of the present invention, the search unit 804 in the information processing device 800 is used to use the time information and the address information of the login log to find at least one corresponding network log in the current network log library when the login type string in the login log is preset information and the login log contains address information.

[0219] In an embodiment of the present invention, the determination unit 805 in the information processing device 800 is used to determine the login tag information based on the port information if the port information contained in the at least one network log is the same; if the port information contained in the at least one network log is not uniform, determine the login tag information based on the log number information in the at least one network log.

[0220] In an embodiment of the present invention, the at least one network log includes: a first network log and a second network log; the first network log includes: first port information and first log number information; the second network log includes: second port information and second log number information; the determination unit 805 in the information processing device 800 is used to determine the target log number information to which the obtained first random number belongs in the first log number information and the second log number information; determine the target port information corresponding to the target log number information in the first port information and the second port information; and determine the login tag information based on the target port information.

[0221] In an embodiment of the present invention, the search unit 804 in the information processing device 800 is used to use the time information of the login log to find at least one corresponding network log in the current network log library when the login type string in the login log is preset information and the login log does not contain address information.

[0222] In an embodiment of the present invention, the determination unit 805 in the information processing device 800 is used to determine the login tag information based on the port information in the at least one network log if the address information contained in the at least one network log is the same; if the various address information contained in the at least one network log is not uniform, determine the target address information in the various address information based on the obtained second random number; and determine the login tag information based on the target address information.

[0223] In an embodiment of the present invention, the determination unit 805 in the information processing device 800 is used to use the time information and the target address information to find at least one corresponding intermediate network log in the current network log library; and determine the login tag information based on the port information in the at least one intermediate network log.

[0224] In an embodiment of the present invention, the at least one network log includes: N network logs; the N network logs include: N log number information; N is an integer greater than 1; the determination unit 805 in the information processing device 800 is used to determine the belonging log number information corresponding to the second random number from the N log number information; and determine the target address information contained in the second network log to which the belonging log number information belongs from each address information.

[0225] In an embodiment of the present invention, the determination unit 805 in the information processing device 800 is used to determine the target address information in the respective address information based on the proportion information of the respective address information if the respective address information contained in the at least one network log is not uniform; determine at least one third network log corresponding to the target address information in the at least one network log; the time information of the at least one third network log is the same; and determine the login tag information based on the port information in the at least one third network log.

[0226] In an embodiment of the present invention, the information acquisition unit 803 in the information processing device 800 is used to obtain network log data accessed by the attack host through preset port information at each time node; wherein the predetermined time period includes multiple time nodes; based on the network log data, the network log corresponding to the same attack host at each time node is formed to obtain multiple network logs; the current network log library is formed through the multiple network logs to update the network log library corresponding to the previous predetermined time period.

[0227] In the embodiment of the present invention, the information acquisition unit 803 in the information processing device 800 is used to acquire the first network log data accessed by the attacking host through the first port information and the second network log data accessed through the second port information at each time node.

[0228] In an embodiment of the present invention, the information processing device 800 is used to determine the first log number information through the number of the first network log data, and then combine the address information of the same attack host, the time information corresponding to each time node and the first port information to form a first node network log; determine the second log number information through the number of the second network log data, and then combine the address information, the time information and the second port information to form a second node network log; obtain the first node network log and the second node network log corresponding to the same attack host at each time node to obtain the multiple network logs.

[0229] In this embodiment of the present invention, information acquisition unit 803 acquires login logs. Search unit 804 searches the current network log database for the corresponding network log information if the login log meets predetermined conditions. Determination unit 805 combines the network logs to determine the login tag information for the login log. Because this solution associates the network log and login log to determine the login tag, it considers more comprehensive factors, thereby improving the accuracy of brute force login detection.

[0230] It should be noted that, in the embodiment of the present invention, if the above-mentioned information processing method is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present invention, or the part that contributes to the relevant technology, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling an information processing device (which can be a personal computer, etc.) to execute all or part of the methods described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM), a magnetic disk or an optical disk. In this way, the embodiment of the present invention is not limited to any specific combination of hardware and software.

[0231] Correspondingly, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which implements the steps in the above method when executed by a processor.

[0232] Correspondingly, an embodiment of the present invention provides an information processing device, including a memory 802 and a processor 801, wherein the memory 802 stores a computer program that can be run on the processor 801, and the processor 801 implements the steps in the above method when executing the program.

[0233] It should be noted that the description of the above storage medium and device embodiments is similar to the description of the above method embodiments and has similar beneficial effects as the method embodiments. For technical details not disclosed in the storage medium and device embodiments of the present invention, please refer to the description of the method embodiments of the present invention for understanding.

[0234] It should be noted that Figure 15 A schematic diagram of a hardware entity of an information processing device provided by an embodiment of the present invention, such as Figure 15 As shown, the hardware entity of the information processing device 800 includes: a processor 801 and a memory 802, wherein;

[0235] The processor 801 generally controls the overall operation of the information processing apparatus 800 .

[0236] The memory 802 is configured to store instructions and applications executable by the processor 801, and can also cache data to be processed or processed by the processor 801 and the various modules in the information processing device 800 (for example, image data, audio data, voice communication data and video communication data), which can be implemented through flash memory (FLASH) or random access memory (Random Access Memory, RAM).

[0237] It should be understood that "one embodiment" or "an embodiment" mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present invention. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention. The serial numbers of the above-mentioned embodiments of the present invention are for description only and do not represent the advantages and disadvantages of the embodiments.

[0238] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0239] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0240] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed across multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0241] In addition, all functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0242] Those skilled in the art will understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiments; and the aforementioned storage medium includes: mobile storage devices, read-only memories (ROM), magnetic disks or optical disks, and other media that can store program codes.

[0243] Alternatively, if the above-mentioned integrated unit of the present invention is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present invention, or the part that contributes to the relevant technology, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0244] The above description is merely an embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. An information processing method, characterized in that: include: Get login logs; In a case where the login type character string in the login log is preset information, searching for a network log corresponding to the login log in the current network log library; Said network logs are obtained through a locally installed lightweight probe; The login type character string includes: Logontype; In combination with the network log, the login tag information of the login log is determined; the login tag information includes: SMB login and RDP login.

2. The information processing method according to claim 1, wherein: When the login type character string in the login log is preset information, searching the current network log library for a network log corresponding to the login log includes: When the login type character string in the login log is preset information and the login log contains address information, at least one corresponding network log is searched in the current network log library using the time information and the address information of the login log.

3. The information processing method according to claim 2, wherein: Determining the login tag information of the login log in combination with the network log includes one of the following: If the port information included in the at least one network log is the same, determining the login tag information based on the port information; If the port information included in the at least one network log is not uniform, the login tag information is determined based on the log number information in the at least one network log.

4. The information processing method according to claim 3, wherein: The at least one network log includes: a first network log and a second network log; the first network log includes: first port information and first log number information; the second network log includes: second port information and second log number information; The determining the login tag information based on the log number information in the at least one network log includes: determining target log number information to which the acquired first random number belongs from the first log number information and the second log number information; Determining target port information corresponding to the target log number information from the first port information and the second port information; The login tag information is determined based on the target port information.

5. The information processing method according to claim 1, wherein: When the login type character string in the login log is preset information, searching the current network log library for a network log corresponding to the login log includes: When the login type character string in the login log is preset information and the login log does not contain address information, at least one corresponding network log is searched in the current network log library using the time information of the login log.

6. The information processing method according to claim 5, characterized in that Determining the login tag information of the login log in combination with the network log includes one of the following: If the address information included in the at least one network log is the same, determining the login tag information based on the port information in the at least one network log; If the respective address information included in the at least one network log is not uniform, determining the target address information from the respective address information based on the obtained second random number; The login tag information is determined based on the target address information.

7. The information processing method according to claim 6, characterized in that: The step of determining the login tag information based on the target address information includes: Searching for at least one corresponding intermediate network log in the current network log library using the time information and the target address information; The login tag information is determined based on the port information in the at least one intermediate network log.

8. The information processing method according to claim 6, wherein: The at least one network log includes: N network logs; the N network logs include: N log number information; N is an integer greater than 1; The determining target address information from each address information based on the obtained second random number includes: Determining the belonging log number information corresponding to the second random number from the N log number information; The target address information included in the second network log to which the belonging log number information belongs is determined in the respective address information.

9. The information processing method according to claim 5, wherein: The determining the login tag information of the login log in combination with the network log includes: If the address information included in the at least one network log is not uniform, determining the target address information from the address information based on the proportion information of the address information; Determining at least one third network log corresponding to the target address information in the at least one network log; the at least one third network log has the same time information; The login tag information is determined based on the port information in the at least one third network log.

10. The information processing method according to claim 1, wherein: In the case where the login type character string in the login log is preset information, before searching the current network log library for the network log corresponding to the login log, the method further includes: Obtaining network log data accessed by the attack host through preset port information at each time node; wherein the predetermined time period includes multiple time nodes; Based on the network log data, forming the network log corresponding to the same attack host at each time node to obtain multiple network logs; The current network log library is formed by using the multiple network logs to update the network log library corresponding to the previous predetermined time period.

11. The information processing method according to claim 10, wherein: The obtaining of network log data accessed by the attack host through the preset port information at each time node includes: Acquire first network log data accessed by the attacking host through the first port information and second network log data accessed through the second port information at each time node.

12. The information processing method according to claim 11, wherein: The forming of the network log corresponding to the same attack host at each time node based on the network log data to obtain multiple network logs includes: Determining first log number information based on the number of the first network log data, and then combining the address information of the same attacking host, the time information corresponding to each time node, and the first port information to form a first node network log; Determine second log number information according to the number of the second network log data, and then combine the address information, the time information and the second port information to form a second node network log; The multiple network logs are obtained by acquiring the first node network log and the second node network log corresponding to the same attacking host at each time node.

13. An information processing device, characterized in that: include: An information acquisition unit, used to acquire login logs; a search unit, configured to search a network log corresponding to the login log in a current network log library when the login type character string in the login log is preset information; Said network logs are obtained through a locally installed lightweight probe; The login type character string includes: Logontype; The determining unit is configured to determine the login tag information of the login log in combination with the network log; the login tag information includes: SMB login and RDP login.

14. An information processing device, characterized in that The method comprises a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the processor executes the program, the steps in the method according to any one of claims 1 to 12 are implemented.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 12 are implemented.

Images