A method and device for preventing credential stuffing attacks

Abstract

This invention provides a method and apparatus for preventing credential stuffing attacks. It obtains the user's MAC address and transaction request, with the transaction request carrying the user's IP address and transaction code. Access to the MAC address is detected according to a pre-configured detection strategy for the transaction code. If the first detection result indicates a credential stuffing attack, the attack is handled according to a pre-set defense strategy for the transaction code. Taking into full account the fact that the user's MAC address cannot be arbitrarily changed, by performing access detection and credential stuffing attack handling on the MAC address of the user initiating the transaction request according to the pre-configured detection and defense strategies for the transaction code carried in the transaction request, the accuracy of credential stuffing attack prevention is improved. Furthermore, by using different detection and defense strategies for different transaction codes, the diversity and flexibility of credential stuffing attack prevention are increased.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method and apparatus for preventing credential stuffing attacks. Background Technology

[0002] Due to the frequent occurrence of cybersecurity incidents, various websites have been strengthening their security measures. To counter malicious actors who attempt to obtain user account passwords through credential stuffing attacks, IP address detection is typically used to identify such attempts. Furthermore, additional defensive measures such as adding standard CAPTCHAs, slider CAPTCHAs, and blocking the IP addresses of malicious actors are employed to prevent these attacks.

[0003] However, because conventional CAPTCHAs such as graphic verification codes or slider verification codes are very easy to crack, and changing IP addresses is low-cost, criminals frequently change their IP addresses and then crack conventional graphic verification codes or slider verification codes to perform credential stuffing attacks. As a result, using existing technologies for credential stuffing defense is inaccurate and has limited prevention and control effects. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a method and apparatus for preventing credential stuffing attacks, in order to improve the accuracy of credential stuffing attacks.

[0005] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0006] The first aspect of this invention discloses a method for preventing credential stuffing attacks, the method comprising:

[0007] Obtain the user's MAC address and the user's transaction request, wherein the transaction request carries the user's IP address and transaction code;

[0008] Access to the MAC address is detected according to the detection strategy pre-configured for the transaction code, and the corresponding first detection result is obtained;

[0009] If the first detection result indicates that a credential stuffing attack has occurred, the credential stuffing attack occurring at the MAC address shall be handled in accordance with the defense strategy pre-set for the transaction code.

[0010] Optionally, the process of pre-configuring a detection strategy for the transaction code includes:

[0011] Determine the type of transaction code;

[0012] Configure the corresponding detection strategy based on the type of the transaction code;

[0013] The detection strategy includes three dimensions of detection rules, which are as follows:

[0014] When the number of times the MAC address accesses the transaction code within a unit of time exceeds a preset number of accesses, it is determined that the MAC address has engaged in a credential stuffing attack.

[0015] When the number of erroneous accesses to the transaction code by the MAC address exceeds a preset number of errors per unit time, it is determined that the MAC address has engaged in a credential stuffing attack.

[0016] When it is detected that the number of times the MAC address accesses the transaction code within a unit of time exceeds a preset number of accesses, and the number of erroneous accesses to the transaction code exceeds a preset number of errors, it is determined that the MAC address has engaged in a credential stuffing attack.

[0017] Optionally, the process of pre-setting a defense strategy for the transaction code includes:

[0018] Determine the type of transaction code;

[0019] Configure the corresponding defense strategy based on the type of the transaction code;

[0020] The defense strategy includes three dimensions of defense rules, which are as follows:

[0021] Access to all transaction codes of the MAC address is prohibited, and a first error message is output, which indicates that the request cannot be processed temporarily.

[0022] Access to the transaction code by the MAC address is prohibited, and the first error message is output.

[0023] Access to the transaction code by the MAC address is prohibited, and a second error message is output, which indicates that the username or password is incorrect.

[0024] Optionally, after handling the credential stuffing attack on the MAC address according to the defense strategy pre-set for the transaction code, the method further includes:

[0025] Output a manual removal prompt to remind operations and maintenance personnel to remove the MAC address that caused the credential stuffing attack.

[0026] Alternatively, the MAC address that was involved in the credential stuffing attack can be made invalid within a pre-set expiration time.

[0027] Optionally, the process of detecting access to the MAC address according to a detection policy pre-configured for the transaction code further includes:

[0028] Access to the IP address is detected according to the detection strategy pre-configured for the transaction code, and a corresponding second detection result is obtained;

[0029] Accordingly, the process of handling credential stuffing attacks occurring on the MAC address according to the defense strategy pre-set for the transaction code also includes:

[0030] The credential stuffing attack that occurs on the IP address is handled according to the defense strategy pre-set for the transaction code.

[0031] A second aspect of this invention discloses a credential stuffing defense device, the device comprising:

[0032] The acquisition unit is used to acquire the user's MAC address and the user's transaction request, wherein the transaction request carries the user's IP address and transaction code;

[0033] The detection unit is used to detect access to the MAC address according to the detection strategy pre-configured for the transaction code and obtain the corresponding first detection result. If the first detection result indicates that a credential stuffing attack has occurred, the processing unit is executed.

[0034] The processing unit is used to process the credential stuffing behavior of the MAC address according to the defense strategy pre-set for the transaction code when the first detection result indicates that a credential stuffing behavior has occurred.

[0035] Optionally, the device further includes: a first configuration unit;

[0036] The first configuration unit is used to determine the type of transaction code and configure the corresponding dimension detection strategy according to the type of transaction code;

[0037] The detection strategy includes three dimensions of detection rules, which are as follows:

[0038] When the number of times the MAC address accesses the transaction code within a unit of time exceeds a preset number of accesses, it is determined that the MAC address has engaged in a credential stuffing attack.

[0039] When the number of erroneous accesses to the transaction code by the MAC address exceeds a preset number of errors per unit time, it is determined that the MAC address has engaged in a credential stuffing attack.

[0040] When it is detected that the number of times the MAC address accesses the transaction code within a unit of time exceeds a preset number of accesses, and the number of erroneous accesses to the transaction code exceeds a preset number of errors, it is determined that the MAC address has engaged in a credential stuffing attack.

[0041] Optionally, the device further includes: a second configuration unit;

[0042] The second configuration unit is used to determine the type of transaction code and configure a corresponding dimension of defense strategy according to the type of transaction code.

[0043] The defense strategy includes three dimensions of defense rules, which are as follows:

[0044] Access to all transaction codes of the MAC address is prohibited, and a first error message is output, which indicates that the request cannot be processed temporarily.

[0045] Access to the transaction code by the MAC address is prohibited, and the first error message is output.

[0046] Access to the transaction code by the MAC address is prohibited, and a second error message is output, which indicates that the username or password is incorrect.

[0047] Optionally, the processing unit is further configured to:

[0048] After handling the credential stuffing attack on the MAC address according to the defense strategy pre-set for the transaction code, a manual deactivation prompt is output to remind the operation and maintenance personnel to deactivate the MAC address that caused the credential stuffing attack; or, according to the pre-set expiration time, the MAC address that caused the credential stuffing attack is made invalid within the expiration time.

[0049] Optionally, the detection unit is further configured to:

[0050] During the process of detecting access to the MAC address according to the detection strategy pre-configured for the transaction code, the access to the IP address is also detected according to the detection strategy pre-configured for the transaction code, and a corresponding second detection result is obtained.

[0051] Accordingly, the processing unit is also used for:

[0052] During the process of handling credential stuffing attacks on the MAC address according to the defense strategy pre-set for the transaction code, credential stuffing attacks on the IP address are also handled according to the defense strategy pre-set for the transaction code.

[0053] A credential stuffing defense method based on the above embodiments of the present invention includes: obtaining the MAC address of a user terminal and a user's transaction request, wherein the transaction request carries the user's IP address and transaction code; detecting access to the MAC address according to a detection policy pre-configured for the transaction code, and obtaining a corresponding first detection result; if the first detection result indicates that a credential stuffing attack has occurred, handling the credential stuffing attack of the MAC address according to a defense policy pre-configured for the transaction code. In the embodiments provided by the present invention, the characteristic that the MAC address of the user terminal cannot be arbitrarily changed is fully considered. By performing access detection and credential stuffing attack handling on the MAC address of the user terminal initiating the transaction request according to the detection and defense policies pre-configured for the transaction code carried in the transaction request, not only is the accuracy of credential stuffing defense improved, but also the diversity and flexibility of credential stuffing defense are increased by using different detection and defense policies configured for different transaction codes. Attached Figure Description

[0054] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0055] Figure 1 A flowchart illustrating a credential stuffing defense method provided in an embodiment of the present invention;

[0056] Figure 2 This is a schematic diagram of an application process for a credential stuffing defense method provided in an embodiment of the present invention;

[0057] Figure 3 A flowchart illustrating another credential stuffing defense method provided in an embodiment of the present invention;

[0058] Figure 4 This is a schematic diagram of a data breach prevention device provided in an embodiment of the present invention. Detailed Implementation

[0059] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0060] In this application, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0061] like Figure 1 As shown, this invention provides a flowchart of a credential stuffing defense method, the method comprising:

[0062] S101: Obtain the user's MAC address and the user's transaction request.

[0063] In S101, the MAC address of the user terminal is fixed in the hardware of the user terminal and cannot be changed at will. Each user terminal has only one unique MAC address.

[0064] The transaction request includes the IP address and transaction code of the user who initiated the transaction request.

[0065] A transaction code is a code used to indicate a specific transaction. Different transaction types correspond to different transaction codes.

[0066] For example, transaction code A000 indicates logging into a transaction.

[0067] Transaction code 4140 indicates an outward remittance transaction.

[0068] During the execution of S101, the transaction request initiated by the user using the client is obtained, and the MAC address of the client is obtained using JS commands.

[0069] S102: Detect the access to the MAC address according to the detection strategy pre-configured for the transaction code, and obtain the corresponding first detection result.

[0070] In S102, this transaction code corresponds to a pre-configured detection strategy. In practical applications, the platform providing the transaction can configure a corresponding detection strategy for each transaction code based on its type.

[0071] Depending on the dimension, this detection strategy can include detection rules in three dimensions.

[0072] The first dimension of MAC detection rules is as follows: when the number of times a MAC address accesses a transaction code within a unit of time exceeds a preset number of accesses, it is determined that the MAC address has engaged in a credential stuffing attack.

[0073] The second dimension of MAC detection rules is as follows: when the number of erroneous accesses to the transaction code by a MAC address exceeds a preset number of errors per unit time, it is determined that the MAC address has engaged in a credential stuffing attack.

[0074] The third dimension of MAC detection rules is as follows: when the number of times a MAC address accesses a transaction code within a unit of time exceeds a preset number of accesses, and the number of erroneous accesses to the transaction code exceeds a preset number of errors, it is determined that the MAC address has engaged in a credential stuffing attack.

[0075] In the specific configuration process for each transaction code, since different types of transaction codes indicate different transaction priorities or importance, different detection rules can be set according to the type of transaction code.

[0076] The process of pre-configuring a detection strategy for the transaction code includes:

[0077] First, determine the type of transaction code.

[0078] Secondly, configure the corresponding detection strategies based on the type of transaction code.

[0079] For example, transaction code A000, which is of type login transaction and has a low priority, is configured with the first dimension of MAC detection rules.

[0080] For example, transaction code 4140, which is a foreign exchange outbound transaction, has a higher priority. Configure a third-dimensional MAC detection rule for transaction code 4140.

[0081] During the execution of S102, the detection strategy pre-configured for the transaction code is invoked, and the access to the MAC address is detected according to the detection strategy. If the MAC address is detected to have engaged in a credential stuffing attack, a first detection result indicating that the MAC address has engaged in a credential stuffing attack is generated; if the MAC address is detected not to have engaged in a credential stuffing attack, a first detection result indicating that the MAC address has not engaged in a credential stuffing attack is generated.

[0082] Let's take the transaction code A000 as an example:

[0083] Compare the number of times the MAC address accesses transaction code A000 within a unit of time to see if it exceeds the preset number of accesses. If it does, it is determined that the MAC address has engaged in a credential stuffing attack. If it does not exceed the preset number of accesses, it is determined that the MAC address has not engaged in a credential stuffing attack.

[0084] For example, compare whether the number of times the MAC address accesses transaction code A000 within 10 minutes exceeds 10,000. If it does, it is determined that the MAC address has engaged in a credential stuffing attack; if it does not, it is determined that the MAC address has not engaged in a credential stuffing attack.

[0085] Let's take transaction code 4140 as an example:

[0086] Compare whether the number of times the MAC address accesses the transaction code within a unit of time exceeds the preset number of accesses, and compare whether the number of times the MAC address makes incorrect accesses to the transaction code within the same unit of time exceeds the preset number of errors. If both exceed the preset number of errors, it is determined that the MAC address has engaged in a credential stuffing attack. If neither exceeds the preset number of accesses, or only the ratio of access counts to incorrect access counts exceeds the preset number of errors, it is determined that the MAC address has not engaged in a credential stuffing attack.

[0087] For example, compare whether the number of times the MAC address accesses transaction code 4140 within 10 minutes exceeds 10,000, and compare whether the number of erroneous accesses to transaction code 4140 within 10 minutes exceeds 1,000. If the number of accesses to transaction code 4140 within 10 minutes exceeds 10,000 and the number of erroneous accesses exceeds 1,000, it is determined that the MAC address has engaged in a credential stuffing attack. If the number of accesses to transaction code 4140 within 10 minutes exceeds 10,000 and the number of erroneous accesses does not exceed 1,000, it is determined that the MAC address has not engaged in a credential stuffing attack. If the number of accesses to transaction code 4140 within 10 minutes does not exceed 10,000 and the number of erroneous accesses exceeds 1,000, it is determined that the MAC address has not engaged in a credential stuffing attack. If the number of accesses to transaction code 4140 within 10 minutes does not exceed 10,000 and the number of erroneous accesses does not exceed 1,000, it is determined that the MAC address has not engaged in a credential stuffing attack.

[0088] S103: If the first detection result indicates that a credential stuffing attack has occurred, the credential stuffing attack occurring at the MAC address shall be handled in accordance with the defense strategy pre-set for the transaction code.

[0089] In S103, this transaction code corresponds to a pre-configured defense strategy. In practical applications, the trading platform can configure corresponding defense strategies for each transaction code based on its type.

[0090] Depending on the dimension, this defense strategy can include defense rules in three dimensions.

[0091] The first dimension of MAC defense rules is: prohibit access to all transaction codes of the MAC address and output the first error message, which is used to indicate that the request cannot be processed temporarily.

[0092] The second-dimensional MAC defense rule is to prohibit MAC addresses from accessing transaction codes and output the first error message.

[0093] The third-dimensional MAC defense rule is to prohibit MAC addresses from accessing transaction codes and output a second error message, which is used to indicate that the username or password is incorrect.

[0094] This third-dimensional MAC defense rule is a superior defense rule. When the first detection result indicates that a credential stuffing attack has occurred, the pre-configured third-dimensional MAC defense strategy is executed, directly blocking login transaction requests initiated by the MAC address involved in the credential stuffing attack, preventing them from entering the login process, and directly displaying an error message "Incorrect username or password." This prevents malicious actors from determining whether the credential stuffing attack has truly failed or has been blocked based on the output error message, thus rendering their efforts futile. Simultaneously, because frequent login transaction requests initiated by MAC addresses are directly blocked and do not enter the login logic, the capacity pressure on the system hosting the login program is significantly reduced.

[0095] In the specific configuration process for each transaction code, since different types of transaction codes indicate different transaction priorities or importance, different dimensions of defense rules can be set according to the type of transaction code.

[0096] The process of pre-configuring a defense strategy for this transaction code includes:

[0097] First, determine the type of transaction code.

[0098] Secondly, configure corresponding defense strategies based on the type of transaction code.

[0099] For example, transaction code A000, which is of type login transaction and has a low priority, is configured with a second-dimensional MAC defense rule.

[0100] For example, transaction code 4140, which is a foreign exchange outbound transaction, has a higher priority. Configure a third-dimensional MAC defense rule for transaction code 4140.

[0101] During the execution of S103, if the first detection result indicates that a credential stuffing attack has occurred, the defense strategy pre-configured for the transaction code is invoked, and the credential stuffing attack occurring on the MAC address is handled in accordance with the defense strategy.

[0102] Let's take the transaction code A000 as an example:

[0103] If the first detection result indicates that a credential stuffing attack has occurred, access to transaction code A000 by the MAC address is prohibited, and the first error message is output, which is used to indicate that the request cannot be processed temporarily.

[0104] Let's take transaction code 4140 as an example:

[0105] If the first detection result indicates that a credential stuffing attack has occurred, access to transaction code 4140 by the MAC address is prohibited, and a second error message is output to indicate that the username or password is incorrect.

[0106] In the embodiments provided by the present invention, the characteristic that the MAC address of the user terminal cannot be changed at will is fully considered. By performing access detection and credential stuffing attack on the MAC address of the user terminal that initiates the transaction request according to the detection and defense strategies pre-configured in the transaction code carried in the transaction request, the accuracy of credential stuffing attack defense is not only improved, but also the diversity and flexibility of credential stuffing attack defense are increased by using different detection and defense strategies for different transaction codes.

[0107] Based on the credential stuffing defense method disclosed in the above embodiments of the present invention, an example is given here. Assume the detection strategy pre-configured for transaction code A000 is: if a MAC address accesses transaction code A000 more than 5000 times within 5 minutes, and the number of erroneous accesses to transaction code A000 exceeds 1000 times, then the MAC address is determined to have engaged in credential stuffing; the defense strategy pre-configured for transaction code A000 is: to prohibit the MAC address from accessing transaction code A000, and to output a second error message "Username or password incorrect". Figure 2 As shown, this invention provides an application flowchart of a credential stuffing defense method, the method comprising:

[0108] S201: Obtain the user's MAC address and the user's transaction request.

[0109] The transaction code carried in the transaction request is A000.

[0110] S202: Detect whether the number of times the MAC address accesses transaction code A000 within 5 minutes exceeds 5000 times, and whether the number of erroneous accesses to transaction code A000 exceeds 1000 times, and obtain the corresponding first detection result.

[0111] If the number of times the MAC address accesses transaction code A000 exceeds 5000 within 5 minutes, and the number of erroneous accesses to transaction code A000 exceeds 1000, it is determined that the MAC address has engaged in a credential stuffing attack, and a first detection result indicating that the MAC address has engaged in a credential stuffing attack is obtained; otherwise, a first detection result indicating that the MAC address has not engaged in a credential stuffing attack is obtained.

[0112] S203: If the first detection result indicates that a credential stuffing attack has occurred, prohibit the MAC address from accessing transaction code A000 and output the second error message "Username or password is incorrect".

[0113] In the embodiments provided by the present invention, the characteristic that the MAC address of the user terminal cannot be changed at will is fully considered. By performing access detection and credential stuffing attack on the MAC address of the user terminal that initiates the transaction request according to the detection and defense strategies pre-configured in the transaction code carried in the transaction request, the accuracy of credential stuffing attack defense is not only improved, but also the diversity and flexibility of credential stuffing attack defense are increased by using different detection and defense strategies for different transaction codes.

[0114] Based on the credential stuffing defense method disclosed in the above embodiments of the present invention, after handling the credential stuffing behavior occurring at the MAC address according to the defense strategy pre-set for the transaction code, it further includes:

[0115] Output a manual removal prompt to remind operations and maintenance personnel to remove the MAC address that caused the credential stuffing attack.

[0116] Alternatively, the MAC address that was involved in the credential stuffing attack can be made invalid within a pre-set expiration time.

[0117] In the embodiments provided by the present invention, by outputting a manual cancellation prompt and / or invalidating the MAC address that has committed a credential stuffing attack within the expiration time, the handling of the MAC address that has committed a credential stuffing attack is realized in multiple ways.

[0118] Based on the credential stuffing defense method disclosed in the above embodiments of the present invention, such as Figure 3 As shown, the present invention also provides a flowchart of another credential stuffing defense method, the method comprising:

[0119] S301: Obtain the user's MAC address and the user's transaction request.

[0120] The specific implementation method of S301 and Figure 1 The specific execution method of S101 shown is the same, and you can refer to the above content for details, which will not be repeated here.

[0121] S302: Detect the access to the MAC address and the access to the IP address according to the detection strategy pre-configured for the transaction code, and obtain a first detection result corresponding to the detection of the access to the MAC address and a second detection result corresponding to the detection of the access to the IP address.

[0122] In S302, the detection strategy for MAC address access is the same as in S102, and will not be repeated here. The detection of IP address access also includes three dimensions of detection rules, specifically:

[0123] The first dimension of IP detection rules is: when the number of times an IP address accesses the transaction code within a unit of time exceeds a preset number of accesses, it is determined that the IP address has engaged in a credential stuffing attack.

[0124] The second dimension of IP detection rules is as follows: when the number of erroneous accesses to the transaction code by an IP address exceeds a preset number of errors per unit time, it is determined that the IP address has engaged in a credential stuffing attack.

[0125] The third-dimensional IP detection rule is as follows: when the number of times an IP address accesses a transaction code within a unit of time exceeds a preset number of accesses, and the number of erroneous accesses to the transaction code exceeds a preset number of errors, it is determined that the IP address has engaged in a credential stuffing attack.

[0126] Similarly, in the process of configuring each transaction code, since different types of transaction codes indicate different transaction priorities or importance, different detection rules can be set according to the type of transaction code.

[0127] For example, transaction code A000, which is of type login transaction and has a low priority, is configured with first-dimensional MAC detection rules and first-dimensional IP detection rules.

[0128] For example, transaction code 4140, which is a foreign exchange outbound transaction, has a higher priority. Configure third-dimensional MAC detection rules and third-dimensional IP detection rules for transaction code 4140.

[0129] During the execution of S302, the detection strategy pre-configured for the transaction code is invoked to detect access to the MAC address and IP address respectively. If the MAC address and the IP address are detected to have engaged in credential stuffing, a first detection result indicating that the MAC address has engaged in credential stuffing and a second detection result indicating that the IP address has engaged in credential stuffing are generated.

[0130] If the detection indicates that the MAC address did not engage in credential stuffing but the IP address did, then a first detection result indicating that the MAC address did not engage in credential stuffing and a second detection result indicating that the IP address did engage in credential stuffing are generated.

[0131] If the MAC address is detected to have engaged in a credential stuffing attack but the IP address is not, a first detection result indicating that the MAC address has engaged in a credential stuffing attack and a second detection result indicating that the IP address is not engaged in a credential stuffing attack are generated.

[0132] If the detection indicates that neither the MAC address nor the IP address has engaged in a credential stuffing attack, then a first detection result indicating that neither the MAC address nor the IP address has engaged in a credential stuffing attack is generated.

[0133] Let's take the transaction code A000 as an example:

[0134] The number of times the MAC address accesses transaction code A000 within a unit of time exceeds a preset number of accesses. If the number of times the MAC address accesses transaction code A000 within a unit of time exceeds the preset number of accesses, it is determined that the MAC address has engaged in a credential stuffing attack. If the number of times the MAC address accesses transaction code A000 within a unit of time does not exceed the preset number of accesses, it is determined that the MAC address has not engaged in a credential stuffing attack.

[0135] Compare the number of times the IP address accesses the transaction code A000 within a unit of time to see if it exceeds a preset number of accesses. If the number of times the IP address accesses the transaction code A000 within a unit of time exceeds the preset number of accesses, it is determined that the IP address has engaged in a credential stuffing attack. If the number of times the IP address accesses the transaction code A000 within a unit of time does not exceed the preset number of accesses, it is determined that the IP address has not engaged in a credential stuffing attack.

[0136] Let's take transaction code 4140 as an example:

[0137] Compare whether the number of times the MAC address accesses transaction code 4140 within a unit of time exceeds the preset number of accesses, and compare whether the number of erroneous accesses to transaction code 4140 by the MAC address within the same unit of time exceeds the preset number of errors. If both exceed the preset number of errors, it is determined that the MAC address has engaged in a credential stuffing attack. If neither exceeds the preset number of accesses, or only the ratio of access counts to erroneous access counts exceeds the preset number of errors, it is determined that the MAC address has not engaged in a credential stuffing attack.

[0138] Compare whether the number of times the IP address accesses transaction code 4140 within a unit of time exceeds the preset number of accesses, and compare whether the number of erroneous accesses to transaction code 4140 by the IP address within the same unit of time exceeds the preset number of errors. If both exceed the preset number of errors, it is determined that the IP address has engaged in credential stuffing. If neither exceeds the preset number of accesses, or only the ratio of access counts to erroneous access counts exceeds the preset number of errors, it is determined that the IP address has not engaged in credential stuffing.

[0139] S303: If the first detection result indicates that the MAC address has committed a credential stuffing attack and / or the second detection result indicates that the IP address has committed a credential stuffing attack, the credential stuffing attack of the MAC address and / or the IP address shall be handled in accordance with the defense strategy pre-set for the transaction code.

[0140] In S303, the defense strategy for MAC addresses that have engaged in credential stuffing attacks is the same as in S103, and will not be repeated here.

[0141] The defense strategy for IP addresses that engage in credential stuffing attacks also includes three dimensions of defense rules, specifically:

[0142] The first-dimensional IP defense rule is to prohibit access to all transaction codes of the IP address and output the first error message, which is used to indicate that the request cannot be processed temporarily.

[0143] The second dimension of IP defense rules is: prohibit IP addresses from accessing the transaction code and output the first error message.

[0144] The third-dimensional IP defense rule is to prohibit IP addresses from accessing the transaction code and output a second error message, which is used to indicate that the username or password is incorrect.

[0145] This third-dimensional IP defense rule is a superior defense rule. When the second detection result indicates that a credential stuffing attack has occurred, the pre-configured third-dimensional IP defense strategy is executed, directly blocking login transaction requests initiated by the IP address that initiated the credential stuffing attack, preventing them from entering the login process, and directly displaying an error message "Incorrect username or password." This prevents malicious actors from determining whether the credential stuffing attack has truly failed or has been blocked based on the output error message, thus rendering their efforts futile. Simultaneously, because frequent login transaction requests from the IP address are directly blocked and do not enter the login logic, the capacity pressure on the system hosting the login program is greatly reduced.

[0146] Similarly, in the process of configuring each transaction code, different defense rules can be set according to the type of transaction code because different types of transaction codes indicate different transaction priorities or importance.

[0147] It should be noted that defense rules targeting MAC addresses take precedence over those targeting IP addresses. Once a defense rule targeting MAC addresses is executed, regardless of whether the currently detected IP address has engaged in credential stuffing attacks, the MAC address will be reported as the primary target.

[0148] For example, transaction code A000, which is a login transaction and has a low priority, can be configured with second-dimensional MAC defense rules and second-dimensional IP defense rules.

[0149] For example, transaction code 4140, which is a foreign exchange outbound transaction, has a higher priority. Configure third-dimensional MAC defense rules and third-dimensional IP defense rules for transaction code 4140.

[0150] During the execution of S303, if the first detection result indicates that the MAC address has engaged in a credential stuffing attack, the defense strategy pre-configured for the transaction code is invoked to handle the MAC address that has engaged in the credential stuffing attack. If the second detection result indicates that the IP address has engaged in a credential stuffing attack, the defense strategy pre-configured for the transaction code is invoked to handle the IP address that has engaged in the credential stuffing attack.

[0151] Let's take the transaction code A000 as an example:

[0152] If the first detection result indicates a credential stuffing attack, access to the transaction code A000 by the MAC address is prohibited, and the first error message is output, indicating that the request cannot be processed temporarily. If the second detection result indicates a credential stuffing attack, access to the transaction code A000 by the IP address is prohibited, and the first error message is output, indicating that the request cannot be processed temporarily.

[0153] When the first detection result indicates that a credential stuffing attack has occurred, the pre-configured third-dimensional MAC defense rules are executed to directly block the login transaction request initiated by the MAC address that caused the credential stuffing attack, preventing it from entering the login process, and directly displaying the error message "Incorrect username or password".

[0154] If the second detection result indicates that a credential stuffing attack has occurred, the pre-configured third-dimensional IP defense rules will be executed to directly block the login transaction request initiated by the IP address that caused the credential stuffing attack, preventing it from entering the login process, and directly displaying the error message "Incorrect username or password".

[0155] By employing the aforementioned defense rules, login transaction requests initiated by MAC addresses or IP addresses that are attempting credential stuffing attacks are directly blocked, preventing them from entering the login process. An error message, "Incorrect username or password," is displayed, making it impossible for malicious actors to determine whether the credential stuffing attempt has genuinely failed or has been blocked, thus thwarting their efforts. Furthermore, because frequent login transaction requests from MAC addresses or IP addresses are directly blocked and do not enter the login logic, the system's capacity is significantly reduced.

[0156] Let's take transaction code 4140 as an example:

[0157] If the first detection result indicates that a credential stuffing attack has occurred, the MAC address is prohibited from accessing transaction code 4140, and a second error message is output to indicate that the username or password is incorrect. If the second detection result indicates that a credential stuffing attack has occurred, the IP address is prohibited from accessing transaction code 4140, and a second error message is output to indicate that the username or password is incorrect.

[0158] In the embodiments provided by this invention, the characteristic that the MAC address of the user terminal cannot be changed at will is fully considered. By performing access detection and credential stuffing attack on the MAC address of the user terminal that initiates the transaction request and the IP address carried in the transaction request according to the detection and defense strategies pre-configured in the transaction code carried in the transaction request, the accuracy of credential stuffing attack defense is not only improved, but also the diversity and flexibility of credential stuffing attack defense are increased by using different detection and defense strategies for different transaction codes.

[0159] Based on the above-described credential stuffing defense method disclosed in this invention, after handling the credential stuffing behavior occurring at the MAC address and / or IP address according to the defense strategy pre-set for the transaction code, the method further includes:

[0160] Output a manual removal prompt to remind operations and maintenance personnel to remove the MAC address and / or IP address that caused the credential stuffing attack.

[0161] Alternatively, the MAC address and / or IP address that are involved in the credential stuffing attack can be made invalid within a pre-set expiration time.

[0162] In the embodiments provided by the present invention, by manually removing the prompts for the MAC address and / or IP address that have engaged in credential stuffing after processing, or by making the MAC address and / or IP address that have engaged in credential stuffing invalid within the expiration time, the processing of the MAC address and / or IP address can be quickly removed in multiple ways.

[0163] like Figure 4 As shown in the diagram, this embodiment of the invention also provides a structural schematic of a data breach defense device 400, which includes:

[0164] The acquisition unit 401 is used to acquire the MAC address of the user terminal and the user's transaction request, wherein the transaction request carries the user's IP address and transaction code.

[0165] The detection unit 402 is used to detect access to the MAC address according to the detection strategy pre-configured for the transaction code and obtain the corresponding first detection result. If the first detection result indicates that a credential stuffing attack has occurred, the processing unit 403 is executed.

[0166] The processing unit 403 is used to process the credential stuffing behavior of the MAC address according to the defense strategy pre-set for the transaction code when the first detection result indicates that a credential stuffing behavior has occurred.

[0167] After the processing unit 403 processes the credential stuffing attack on the MAC address according to the defense strategy pre-set for the transaction code, it is further configured to: output a manual cancellation prompt to prompt the operation and maintenance personnel to cancel the MAC address that caused the credential stuffing attack; or, according to a pre-set expiration time, make the MAC address that caused the credential stuffing attack expire within the expiration time.

[0168] In order to pre-configure the detection strategy for the transaction code, the credential stuffing defense device 400 further includes: a first configuration unit 404.

[0169] The first configuration unit 404 is used to determine the type of transaction code and configure the corresponding dimension detection strategy according to the type of transaction code.

[0170] The detection strategy includes three dimensions of detection rules, which are as follows:

[0171] When the number of times the MAC address accesses the transaction code within a unit of time exceeds a preset number of accesses, it is determined that the MAC address has engaged in a credential stuffing attack.

[0172] When the number of erroneous accesses to the transaction code by the MAC address within a unit of time exceeds a preset number of errors, it is determined that the MAC address has engaged in a credential stuffing attack.

[0173] When it is detected that the number of times the MAC address accesses the transaction code within a unit of time exceeds a preset number of accesses, and the number of erroneous accesses to the transaction code exceeds a preset number of errors, it is determined that the MAC address has engaged in a credential stuffing attack.

[0174] In order to pre-configure defense strategies for transaction codes, the credential stuffing defense device 400 further includes a second configuration unit 405.

[0175] The second configuration unit 405 is used to determine the type of transaction code and configure a corresponding dimension of defense strategy according to the type of transaction code.

[0176] The defense strategy includes three dimensions of defense rules, which are as follows:

[0177] Access to all transaction codes of the MAC address is prohibited, and a first error message is output, indicating that the request cannot be processed temporarily.

[0178] Access to the transaction code by the MAC address is prohibited, and the first error message is output.

[0179] Access to the transaction code by the MAC address is prohibited, and a second error message is output, which indicates that the username or password is incorrect.

[0180] It should be noted that the specific principles and execution processes of each unit in the credential stuffing defense device 400 disclosed in the above embodiments of the present invention are the same as those of the credential stuffing defense method disclosed in the above embodiments of the present invention. Please refer to the corresponding parts of the credential stuffing defense method disclosed in the above embodiments of the present invention, and they will not be repeated here.

[0181] In one embodiment of the present invention, the detection unit 402 is further configured to: during the process of detecting access to the MAC address according to the detection strategy pre-configured for the transaction code, detect access to the IP address according to the detection strategy pre-configured for the transaction code, and obtain a corresponding second detection result; if the second detection result indicates that a credential stuffing attack has occurred, execute the processing unit 403.

[0182] The processing unit 403 is also used to process the credential stuffing behavior of the IP address according to the defense strategy pre-set for the transaction code during the process of processing the credential stuffing behavior of the MAC address according to the defense strategy pre-set for the transaction code.

[0183] The process by which the detection unit 402 and the processing unit 403 simultaneously detect MAC addresses and IP addresses, and perform corresponding processing based on their respective detection results, can be found in the above-described embodiments of the present invention. Figure 3 The publicly available text content will not be repeated here.

[0184] In the embodiments provided by the present invention, the characteristic that the MAC address of the user terminal cannot be changed at will is fully considered. By performing access detection and credential stuffing attack on the MAC address of the user terminal that initiates the transaction request according to the detection and defense strategies pre-configured in the transaction code carried in the transaction request, the accuracy of credential stuffing attack defense is not only improved, but also the diversity and flexibility of credential stuffing attack defense are increased by using different detection and defense strategies for different transaction codes.

[0185] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for system or system embodiments, since they are basically similar to method embodiments, the description is relatively simple, and relevant parts can be referred to the descriptions in the method embodiments. The systems and system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0186] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0187] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for preventing credential stuffing attacks, characterized in that, The method includes: Obtain the user's MAC address and the user's transaction request, wherein the transaction request carries the user's IP address and transaction code; Access to the MAC address is detected according to the detection strategy pre-configured for the transaction code, and a corresponding first detection result is obtained. Different types of transaction codes indicate different transaction priorities, and a corresponding detection strategy is configured for each transaction code according to its type. If the first detection result indicates that a credential stuffing attack has occurred, the credential stuffing attack occurring at the MAC address shall be handled in accordance with the defense strategy pre-set for the transaction code; The process of pre-configuring a detection strategy for the transaction code includes: Determine the type of transaction code; Configure the corresponding dimension detection strategy according to the type of the transaction code; configure the first dimension MAC detection rule for transactions with lower priority indicated by the type of the transaction code, and configure the third dimension MAC detection rule for transactions with higher priority indicated by the type of the transaction code. The detection strategy includes three dimensions of detection rules, which are as follows: The first dimension of MAC detection rules is: when the number of times the MAC address accesses the transaction code within a unit of time exceeds the preset number of accesses, it is determined that the MAC address has engaged in a credential stuffing attack. The second dimension of MAC detection rules is as follows: when the number of erroneous accesses to the transaction code by the MAC address exceeds the preset number of errors per unit time, it is determined that the MAC address has engaged in a credential stuffing attack. The third dimension of MAC detection rules is as follows: when the number of times the MAC address accesses the transaction code within a unit of time exceeds a preset number of accesses, and the number of erroneous accesses to the transaction code exceeds a preset number of errors, it is determined that the MAC address has engaged in a credential stuffing attack. The process of pre-setting the defense strategy for the transaction code includes: Determine the type of transaction code; Configure a corresponding dimension of defense strategy based on the type of the transaction code; configure a second dimension of MAC defense strategy for transactions with lower priority indicated by the type of the transaction code, and configure a third dimension of MAC defense strategy for transactions with higher priority indicated by the type of the transaction code. The defense strategy includes three dimensions of defense rules, which are: The first dimension of MAC defense rules is: prohibit access to all transaction codes of the MAC address and output a first error message, which is used to indicate that the request cannot be processed temporarily; The second dimension of MAC defense rules is: prohibit the MAC address from accessing the transaction code, and output the first error message; The third-dimensional MAC defense rule is to prohibit the MAC address from accessing the transaction code and output a second error message, which is used to indicate that the username or password is incorrect.

2. The method according to claim 1, characterized in that, After handling the credential stuffing attack on the MAC address according to the defense strategy pre-set for the transaction code, the method further includes: Output a manual removal prompt to remind operations and maintenance personnel to remove the MAC address that caused the credential stuffing attack. Alternatively, the MAC address that caused the credential stuffing attack can be made invalid within a pre-set expiration time.

3. The method according to claim 1, characterized in that, The process of detecting access to the MAC address according to a detection policy pre-configured for the transaction code also includes: Access to the IP address is detected according to the detection strategy pre-configured for the transaction code, and a corresponding second detection result is obtained; Accordingly, the process of handling credential stuffing attacks occurring on the MAC address according to the defense strategy pre-set for the transaction code also includes: The credential stuffing attack that occurs on the IP address is handled according to the defense strategy pre-set for the transaction code.

4. A data breach prevention device, characterized in that, The device includes: The acquisition unit is used to acquire the user's MAC address and the user's transaction request, wherein the transaction request carries the user's IP address and transaction code; The detection unit is used to detect access to the MAC address according to the detection strategy pre-configured for the transaction code and obtain the corresponding first detection result. If the first detection result indicates that a credential stuffing attack has occurred, the processing unit is executed. The different types of transaction codes indicate different transaction priorities, and a corresponding detection strategy is configured for each transaction code according to its type. The processing unit is used to process the credential stuffing behavior of the MAC address according to the defense strategy pre-set for the transaction code when the first detection result indicates that a credential stuffing behavior has occurred; The device further includes: a first configuration unit; The first configuration unit is used to determine the type of transaction code and configure a detection strategy of the corresponding dimension according to the type of transaction code; if the transaction priority indicated by the type of transaction code is low, a MAC detection rule of the first dimension is configured, and if the transaction priority indicated by the type of transaction code is high, a MAC detection rule of the third dimension is configured. The detection strategy includes three dimensions of detection rules, which are as follows: The first dimension of MAC detection rules is: when the number of times the MAC address accesses the transaction code within a unit of time exceeds the preset number of accesses, it is determined that the MAC address has engaged in a credential stuffing attack. The second dimension of MAC detection rules is as follows: when the number of erroneous accesses to the transaction code by the MAC address exceeds the preset number of errors per unit time, it is determined that the MAC address has engaged in a credential stuffing attack. The third dimension of MAC detection rules is as follows: when the number of times the MAC address accesses the transaction code within a unit of time exceeds a preset number of accesses, and the number of erroneous accesses to the transaction code exceeds a preset number of errors, it is determined that the MAC address has engaged in a credential stuffing attack. The device further includes: a second configuration unit; The second configuration unit is used to determine the type of transaction code; configure a corresponding dimension of defense strategy according to the type of transaction code; configure a second dimension MAC defense strategy if the priority indicated by the type of transaction code is lower, and configure a third dimension MAC defense strategy if the priority indicated by the type of transaction code is higher. The defense strategy includes three dimensions of defense rules, which are: The first dimension of MAC defense rules is: prohibit access to all transaction codes of the MAC address and output a first error message, which is used to indicate that the request cannot be processed temporarily; The second dimension of MAC defense rules is: prohibit the MAC address from accessing the transaction code, and output the first error message; The third-dimensional MAC defense rule is to prohibit the MAC address from accessing the transaction code and output a second error message, which is used to indicate that the username or password is incorrect.

5. The apparatus according to claim 4, characterized in that, The processing unit is further configured to: After handling the credential stuffing attack on the MAC address according to the defense strategy pre-set for the transaction code, a manual deactivation prompt is output to remind the operation and maintenance personnel to deactivate the MAC address that caused the credential stuffing attack; or, according to the pre-set expiration time, the MAC address that caused the credential stuffing attack is made invalid within the expiration time.

6. The apparatus according to claim 4, characterized in that, The detection unit is also used for: During the process of detecting access to the MAC address according to the detection strategy pre-configured for the transaction code, the access to the IP address is also detected according to the detection strategy pre-configured for the transaction code, and a corresponding second detection result is obtained. Accordingly, the processing unit is also used for: During the process of handling credential stuffing attacks on the MAC address according to the defense strategy pre-set for the transaction code, credential stuffing attacks on the IP address are also handled according to the defense strategy pre-set for the transaction code.

Images