Defense methods against brute-force attacks on network traffic, security gateways and terminal devices

Abstract

This application provides a method, security gateway, terminal device, electronic device, and storage medium for defending against brute-force attacks on network traffic. The method includes: acquiring network traffic; performing a brute-force attack suspicion analysis on the network traffic to obtain analysis results; sending a receive signal to the terminal device based on the analysis results, so that the terminal device receives the network traffic; receiving a set of program names generated by the terminal device based on the network traffic; and defending against the brute-force attack based on the set of program names. Implementing this application embodiment can improve the efficiency of defending against brute-force attacks on network traffic, accurately distinguish between ordinary user login behavior and brute-force attacks, avoid omissions in brute-force attacks, reduce the burden of defense work, effectively reduce costs, and improve defense speed.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a method for defending against brute-force attacks on traffic, a security gateway, and a terminal device. Background Technology

[0002] Brute-force attacks are a common attack method used by attackers. They use software tools to try different usernames and passwords sequentially using a dictionary file, even without knowing the username and password.

[0003] Existing technologies typically utilize security gateways to detect brute-force attacks by analyzing frequency and message content. However, because slow brute-force attacks are similar to the behavior of ordinary users repeatedly attempting to log in, false alarms are easily generated. These attacks mistakenly identify the repeated login attempts of ordinary users as brute-force attacks, leading to frequent errors in brute-force attack defense. This results in legitimate users being defended or slow brute-force attacks being missed, placing a heavy burden on the defense system and reducing its efficiency. Summary of the Invention

[0004] The purpose of this application is to provide a method, security gateway, terminal device, electronic device, and storage medium for defending against brute-force attacks on traffic. This method can improve the efficiency of defending against brute-force attacks on traffic, accurately distinguish between the login behavior of ordinary users and brute-force attacks, avoid omissions in brute-force attacks, reduce the burden of defense work, effectively reduce costs, and improve defense speed.

[0005] In a first aspect, embodiments of this application provide a method for defending against brute-force attacks on traffic, used in a security gateway, the method comprising:

[0006] Obtain network traffic;

[0007] The network traffic was subjected to a brute-force attack suspicion analysis, and the analysis results were obtained.

[0008] Based on the analysis results, a receive signal is sent to the terminal device so that the terminal device can receive the network traffic;

[0009] Receive the set of program names generated by the terminal device based on the network traffic;

[0010] Defend against brute-force attacks based on the set of program names.

[0011] In the above implementation process, after performing suspiciousness analysis on brute-force attacks, defense against brute-force attacks is carried out based on the set of program names. This can effectively and quickly identify brute-force attacks, improve the efficiency of brute-force attack defense, accurately distinguish the login behavior of ordinary users from brute-force attacks, avoid omissions of brute-force attacks, reduce the burden of defense work, effectively reduce costs, and improve defense speed.

[0012] Furthermore, the step of performing a brute-force attack suspicion analysis on the network traffic and obtaining the analysis results includes:

[0013] Perform brute-force analysis on the network traffic;

[0014] If the network traffic is normal traffic, the five-tuple information of the network traffic will be used as the analysis result;

[0015] If the network traffic is suspicious, obtain the port information of the network traffic and send the port information to the terminal device so that the terminal device returns the program name corresponding to the port information.

[0016] In the above implementation process, different processing methods are applied to normal traffic and suspicious traffic, which can quickly distinguish the type of network traffic and improve the defense effectiveness against brute-force attacks.

[0017] Furthermore, the step of defending against the brute-force attack based on the set of program names includes:

[0018] The set of program names is recorded in a pre-built login program table and a pre-built list of frequently used logins;

[0019] Defense against brute-force attacks is based on a login program table that records the set of program names and a list of frequently used logins.

[0020] In the above implementation process, the set of program names is recorded in a pre-built login program table and a frequently used login list, which can effectively record the login status of different programs and facilitate the defense against brute-force attacks on programs.

[0021] Further, the step of recording the set of program names into a pre-built login program table and a pre-built frequently used login list includes:

[0022] The program names in the program name set are recorded sequentially into the pre-built login program table;

[0023] The login program table corresponding to each recorded program name is updated to obtain the current record count;

[0024] Determine whether the current record count has reached the record threshold;

[0025] If so, add the program name corresponding to the current number of records to the pre-built list of frequently used logins.

[0026] In the above implementation process, the program names are recorded differently, which can quickly distinguish the login status of the program, making it easier to identify frequently used programs and reducing the subsequent process of defending against brute-force attacks.

[0027] Furthermore, the step of defending against the brute-force attack based on the login program table recording the set of program names and the frequently used login list includes:

[0028] Receive the program name corresponding to the port information sent from the terminal device;

[0029] Based on the port information, query the login program table and the frequently used login list that record the program name set to see if the program name corresponding to the port information is included;

[0030] If so, a receive signal is sent to the terminal device so that the terminal device receives network traffic for the program name corresponding to the port information;

[0031] If not, issue an alarm message to defend against network traffic to the program name corresponding to the port information.

[0032] In the above implementation process, the network traffic of different program names can be defended quickly and accurately based on the login program table and the frequently used login list, which improves the defense efficiency against brute-force attacks.

[0033] Furthermore, prior to the step of acquiring network traffic, the method also includes:

[0034] Receive operational information from the terminal device;

[0035] Generate response information based on the operational information;

[0036] The response information is sent to the terminal device to ensure that the terminal device operates normally.

[0037] In the above implementation process, the response information can be used to quickly determine whether the security gateway and terminal devices are in normal working order, which can reduce waiting time.

[0038] Secondly, embodiments of this application provide a method for defending against brute-force attacks on traffic, for use in a terminal device, the method comprising:

[0039] Receive signals from the security gateway;

[0040] Receive network traffic according to the received signal;

[0041] Based on the network traffic query connection information, generate a set of program names;

[0042] The set of program names is sent to the security gateway so that the security gateway can defend against the brute-force attack based on the set of program names.

[0043] In the above implementation process, network traffic is received based on the security gateway's received signals, and a set of program names is generated based on the connection information. This can improve data support for the security gateway and further improve its response time.

[0044] Furthermore, after the step of querying connection information based on the network traffic and generating a set of program names, the method further includes:

[0045] Receive port information from the security gateway;

[0046] The connection information is queried based on the port information to obtain the program name corresponding to the port information;

[0047] Send the program name corresponding to the port information to the security gateway.

[0048] In the above implementation process, querying connection information based on port information to obtain the program name and sending the program name to the security gateway can improve the data transmission efficiency between the terminal device and the security gateway.

[0049] Furthermore, prior to the step of receiving the received signal from the security gateway, the method further includes:

[0050] Send operation information to the security gateway so that the security gateway returns response information;

[0051] Receive the response information sent from the security gateway.

[0052] In the above implementation process, the terminal device sends connection information to the security gateway and receives the response information returned by the security gateway to ensure that the terminal device and the security gateway can connect accurately and quickly.

[0053] Thirdly, embodiments of this application also provide a security gateway, the security gateway comprising:

[0054] The acquisition module is used to acquire network traffic;

[0055] The analysis module is used to perform brute-force attack suspicion analysis on the network traffic and obtain analysis results;

[0056] The gateway sending module is used to send a receiving signal to the terminal device based on the analysis results, so that the terminal device can receive the network traffic;

[0057] The gateway receiving module is used to receive the set of program names generated by the terminal device based on the network traffic;

[0058] The defense module is used to defend against the brute-force attack based on the set of program names.

[0059] In the above implementation process, after performing suspiciousness analysis on brute-force attacks, defense against brute-force attacks is carried out based on the set of program names. This can effectively and quickly identify brute-force attacks, improve the efficiency of brute-force attack defense, accurately distinguish the login behavior of ordinary users from brute-force attacks, avoid omissions of brute-force attacks, reduce the burden of defense work, effectively reduce costs, and improve defense speed.

[0060] Fourthly, embodiments of this application also provide a terminal device, the terminal device comprising:

[0061] The terminal receiving module is used to receive received signals from the security gateway; and is also used to receive network traffic based on the received signals.

[0062] The generation module is used to query connection information based on the network traffic and generate a set of program names;

[0063] The terminal sending module is used to send the set of program names to the security gateway, so that the security gateway can defend against the brute-force attack based on the set of program names.

[0064] In the above implementation process, network traffic is received based on the security gateway's received signals, and a set of program names is generated based on the connection information. This can improve data support for the security gateway and further improve its response time.

[0065] Fifthly, embodiments of this application also provide a defense system against brute-force attacks on traffic, the system comprising:

[0066] The acquisition module is used to acquire network traffic;

[0067] The analysis module is used to perform brute-force attack suspicion analysis on the network traffic and obtain analysis results;

[0068] The gateway sending module is used to send a receiving signal to the terminal device based on the analysis results, so that the terminal device can receive the network traffic;

[0069] The gateway receiving module is used to receive the set of program names generated by the terminal device based on the network traffic;

[0070] A defense module is used to defend against the brute-force attack based on the set of program names;

[0071] The terminal receiving module is used to receive received signals from the security gateway; and is also used to receive network traffic based on the received signals.

[0072] The generation module is used to query connection information based on the network traffic and generate a set of program names;

[0073] The terminal sending module is used to send the set of program names to the security gateway, so that the security gateway can defend against the brute-force attack based on the set of program names.

[0074] Sixthly, an electronic device provided in this application includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method as described in either the first or second aspect.

[0075] In a seventh aspect, embodiments of this application provide a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method described in either the first or second aspect.

[0076] Eighthly, an embodiment of this application provides a computer program product that, when run on a computer, causes the computer to perform the method described in either the first or second aspect.

[0077] Other features and advantages of this disclosure will be set forth in the following description, or some features and advantages may be inferred from the description or determined without doubt, or may be learned by practicing the techniques described above.

[0078] It can be implemented in accordance with the contents of the specification. The preferred embodiments of this application are described in detail below with reference to the accompanying drawings. Attached Figure Description

[0079] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation on the range. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0080] Figure 1 A flowchart illustrating the method for defending against brute-force attacks on traffic provided in this application embodiment;

[0081] Figure 2 A flowchart illustrating another method for defending against brute-force attacks on traffic, provided in an embodiment of this application;

[0082] Figure 3 This is a schematic diagram of the structural composition of the security gateway provided in the embodiments of this application;

[0083] Figure 4 This is a schematic diagram of the structural composition of the terminal device provided in the embodiments of this application;

[0084] Figure 5 This is a schematic diagram of the structural composition of the electronic device provided in the embodiments of this application. Detailed Implementation

[0085] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0086] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0087] The specific embodiments of this application will be described in further detail below with reference to the accompanying drawings and examples. The following examples are used to illustrate this application, but are not intended to limit the scope of this application.

[0088] Example 1

[0089] Figure 1 This is a flowchart illustrating the method for defending against brute-force attacks on traffic provided in this application embodiment, as shown below. Figure 1 As shown, the method includes:

[0090] S10, acquire network traffic;

[0091] S11, perform a brute-force attack suspicion analysis on network traffic and obtain the analysis results;

[0092] S12, based on the analysis results, send a receive signal to the terminal device so that the terminal device can receive network traffic;

[0093] S13, receiving a set of program names generated by the terminal device based on network traffic;

[0094] S14, defense against brute-force attacks based on a set of program names.

[0095] In the above implementation process, after performing suspiciousness analysis on brute-force attacks, defense against brute-force attacks is carried out based on the set of program names. This can effectively and quickly identify brute-force attacks, improve the efficiency of brute-force attack defense, accurately distinguish the login behavior of ordinary users from brute-force attacks, avoid omissions of brute-force attacks, reduce the burden of defense work, effectively reduce costs, and improve defense speed.

[0096] Furthermore, S11 includes:

[0097] Brute-force judgment of network traffic;

[0098] If the network traffic is normal, the five-tuple information of the network traffic will be used as the analysis result;

[0099] If the network traffic is suspicious, obtain the port information of the network traffic and send the port information to the terminal device so that the terminal device returns the program name corresponding to the port information.

[0100] In the above implementation process, different processing methods are applied to normal traffic and suspicious traffic, which can quickly distinguish the type of network traffic and improve the defense effectiveness against brute-force attacks.

[0101] The security gateway performs brute-force attacks on network traffic. If it is certain that the network traffic is normal (successful login and continuous business traffic), it notifies the terminal program to collect the data based on the five-tuple information of the network traffic.

[0102] Furthermore, S14 includes:

[0103] Record the set of program names into a pre-built login program table and a pre-built list of frequently used logins;

[0104] Defense against brute-force attacks is based on a login program table containing a set of recorded program names and a list of frequently used logins.

[0105] In the above implementation process, the set of program names is recorded in a pre-built login program table and a frequently used login list, which can effectively record the login status of different programs and facilitate the defense against brute-force attacks on programs.

[0106] Furthermore, the step of recording the set of program names into a pre-built login program table and a pre-built list of frequently used logins includes:

[0107] Record the program names in the program name set into the pre-built login program table in sequence;

[0108] The login program table corresponding to each recorded program name is updated to obtain the current record count;

[0109] Determine if the current record count has reached the record threshold;

[0110] If so, add the program name corresponding to the current number of records to the pre-built list of frequently used logins.

[0111] In the above implementation process, the program names are recorded differently, which can quickly distinguish the login status of the program, making it easier to identify frequently used programs and reducing the subsequent process of defending against brute-force attacks.

[0112] The security gateway collects client software for common applications such as telnet, ftp, and remote desktop. It has a built-in "Common Login Programs Table," where the key is the terminal device's IP address and the application protocol (e.g., telnet, ftp), and the value is a list of program names. The security gateway records each program name from the set into the "Login Programs Table," with the key being the terminal device's IP address and the application protocol (e.g., telnet, ftp), and the value being the list of program names. It also increments the login count by 1. If a record in the "Login Programs Table" reaches its login count threshold, and the application protocol is a preset protocol, then that record is added to the "Common Login Programs Table."

[0113] Furthermore, the steps for defending against brute-force attacks based on a login program table containing a set of recorded program names and a list of frequently used logins include:

[0114] The program name corresponding to the port information received from the terminal device;

[0115] Based on the port information, query the login program table and the frequently used login list containing the set of program names to see if the program name corresponding to the port information is included.

[0116] If so, send a receive signal to the terminal device so that the terminal device can receive network traffic corresponding to the program name of the port information;

[0117] If not, issue an alarm message to defend against network traffic from the program name corresponding to the port information.

[0118] In the above implementation process, the network traffic of different program names can be defended quickly and accurately based on the login program table and the frequently used login list, which improves the defense efficiency against brute-force attacks.

[0119] The security gateway detects suspicious brute-force attacks, including slow brute-force attacks, which are infrequent. It sends the service device IP, service device port, client IP, and protocol type information to the terminal program of the terminal device corresponding to the client IP.

[0120] The security gateway searches the "Login Program Table" and "Common Login Program Table" based on the terminal device's IP address and application type to determine if the program name is in a certain table. If it is found, it is considered a login attempt by a normal user and no further processing is performed. If it is not found, it is considered a suspicious attack and an alarm message is issued or the message is blocked.

[0121] Furthermore, prior to the step of acquiring network traffic, the following steps are also included:

[0122] Receive operational information from terminal devices;

[0123] Generate response information based on operational information;

[0124] The response information is sent to the terminal device to ensure that the terminal device functions properly.

[0125] In the above implementation process, the response information can be used to quickly determine whether the security gateway and terminal devices are in normal working order, which can reduce waiting time.

[0126] In this embodiment, the security gateway starts a network service on its own routing port for communication with the terminal program. For example, the communication protocol can use the standard HTTPS, and the terminal device can make business calls to the security gateway through REST API.

[0127] The terminal device runs on the user's PC and sends a heartbeat to the security gateway every 10 seconds. After receiving the heartbeat, the security gateway returns a response message to the terminal device.

[0128] Example 2

[0129] Figure 2 This is a flowchart illustrating the method for defending against brute-force attacks on traffic provided in this application embodiment, as shown below. Figure 2 As shown, the method includes:

[0130] S20, receive the received signal from the security gateway;

[0131] S21, Receive network traffic based on the received signal;

[0132] S22, query connection information based on network traffic and generate a set of program names;

[0133] S23, send the set of program names to the security gateway so that the security gateway can defend against brute-force attacks based on the set of program names.

[0134] In the above implementation process, network traffic is received based on the security gateway's received signals, and a set of program names is generated based on the connection information. This can improve data support for the security gateway and further improve its response time.

[0135] Furthermore, after the step of querying connection information based on network traffic and generating a set of program names, the process also includes:

[0136] Receive port information from the security gateway;

[0137] Query the connection information based on the port information to obtain the program name corresponding to the port information;

[0138] Send the program name corresponding to the port information to the security gateway.

[0139] In the above implementation process, querying connection information based on port information to obtain the program name and sending the program name to the security gateway can improve the data transmission efficiency between the terminal device and the security gateway.

[0140] The terminal program queries the current connection information in the system, collects the names of programs that the terminal device uses and that have login activity, and then sends the program names to the security gateway.

[0141] Furthermore, prior to the step of receiving the received signal from the security gateway, the procedure also includes:

[0142] Send runtime information to the security gateway so that the security gateway can return a response.

[0143] Receive response information from the security gateway.

[0144] In the above implementation process, the terminal device sends connection information to the security gateway and receives the response information returned by the security gateway to ensure that the terminal device and the security gateway can connect accurately and quickly.

[0145] Example 3

[0146] In order to execute the method corresponding to Embodiment 1 above and achieve the corresponding functions and technical effects, a security gateway is provided below, such as... Figure 3 As shown, the security gateway includes:

[0147] Module 10 is used to acquire network traffic;

[0148] Analysis module 11 is used to perform brute-force attack suspicion analysis on network traffic and obtain analysis results;

[0149] Gateway sending module 12 is used to send a receiving signal to the terminal device based on the analysis results, so that the terminal device can receive network traffic;

[0150] Gateway receiving module 13 is used to receive a set of program names generated by the terminal device based on network traffic;

[0151] Defense module 14 is used to defend against brute-force attacks based on a set of program names.

[0152] In the above implementation process, after performing suspiciousness analysis on brute-force attacks, defense against brute-force attacks is carried out based on the set of program names. This can effectively and quickly identify brute-force attacks, improve the efficiency of brute-force attack defense, accurately distinguish the login behavior of ordinary users from brute-force attacks, avoid omissions of brute-force attacks, reduce the burden of defense work, effectively reduce costs, and improve defense speed.

[0153] Furthermore, the analysis module 11 is also used for:

[0154] Brute-force judgment of network traffic;

[0155] If the network traffic is normal, the five-tuple information of the network traffic will be used as the analysis result;

[0156] If the network traffic is suspicious, obtain the port information of the network traffic and send the port information to the terminal device so that the terminal device returns the program name corresponding to the port information.

[0157] In the above implementation process, different processing methods are applied to normal traffic and suspicious traffic, which can quickly distinguish the type of network traffic and improve the defense effectiveness against brute-force attacks.

[0158] Furthermore, the defense module 14 is also used for:

[0159] Record the set of program names into a pre-built login program table and a pre-built list of frequently used logins;

[0160] Defense against brute-force attacks is based on a login program table containing a set of recorded program names and a list of frequently used logins.

[0161] In the above implementation process, the set of program names is recorded in a pre-built login program table and a frequently used login list, which can effectively record the login status of different programs and facilitate the defense against brute-force attacks on programs.

[0162] Furthermore, the defense module 14 is also used for:

[0163] Record the program names in the program name set into the pre-built login program table in sequence;

[0164] The login program table corresponding to each recorded program name is updated to obtain the current record count;

[0165] Determine if the current record count has reached the record threshold;

[0166] If so, add the program name corresponding to the current number of records to the pre-built list of frequently used logins.

[0167] In the above implementation process, the program names are recorded differently, which can quickly distinguish the login status of the program, making it easier to identify frequently used programs and reducing the subsequent process of defending against brute-force attacks.

[0168] Furthermore, the defense module 14 is also used for:

[0169] The program name corresponding to the port information received from the terminal device;

[0170] Based on the port information, query the login program table and the frequently used login list containing the set of program names to see if the program name corresponding to the port information is included.

[0171] If so, send a receive signal to the terminal device so that the terminal device can receive network traffic corresponding to the program name of the port information;

[0172] If not, issue an alarm message to defend against network traffic from the program name corresponding to the port information.

[0173] In the above implementation process, the network traffic of different program names can be defended quickly and accurately based on the login program table and the frequently used login list, which improves the defense efficiency against brute-force attacks.

[0174] Furthermore, the security gateway also includes a gateway response module for:

[0175] Receive operational information from terminal devices;

[0176] Generate response information based on operational information;

[0177] The response information is sent to the terminal device to ensure that the terminal device functions properly.

[0178] In the above implementation process, the response information can be used to quickly determine whether the security gateway and terminal devices are in normal working order, which can reduce waiting time.

[0179] The security gateway defending against brute-force attacks on traffic described above can implement the method of Embodiment 1. The options in Embodiment 1 are also applicable to this embodiment, and will not be described in detail here.

[0180] The remaining contents of this embodiment can be referred to the contents of Embodiment 1 above, and will not be repeated in this embodiment.

[0181] Example 4

[0182] In order to execute the method corresponding to Embodiment 2 above and achieve the corresponding functions and technical effects, a terminal device is provided below, such as... Figure 4 As shown, the device includes:

[0183] The terminal receiving module 20 is used to receive received signals from the security gateway; it is also used to receive network traffic based on the received signals.

[0184] Generation module 21 is used to query connection information based on network traffic and generate a set of program names;

[0185] The terminal sending module 22 is used to send a set of program names to the security gateway so that the security gateway can defend against brute-force attacks based on the set of program names.

[0186] In the above implementation process, network traffic is received based on the security gateway's received signals, and a set of program names is generated based on the connection information. This can improve data support for the security gateway and further improve its response time.

[0187] Furthermore, the terminal receiving module 20 is also used for:

[0188] Receive port information from the security gateway;

[0189] Query the connection information based on the port information to obtain the program name corresponding to the port information;

[0190] Furthermore, the terminal sending module 22 is also used for:

[0191] Send the program name corresponding to the port information to the security gateway.

[0192] In the above implementation process, querying connection information based on port information to obtain the program name and sending the program name to the security gateway can improve the data transmission efficiency between the terminal device and the security gateway.

[0193] Furthermore, the terminal device also includes a terminal response module, used for:

[0194] Send runtime information to the security gateway so that the security gateway can return a response.

[0195] Receive response information from the security gateway.

[0196] In the above implementation process, the terminal device sends connection information to the security gateway and receives the response information returned by the security gateway to ensure that the terminal device and the security gateway can connect accurately and quickly.

[0197] The terminal device defending against the aforementioned brute-force attacks on traffic can implement the method of Embodiment 2. The options in Embodiment 1 also apply to this embodiment, and will not be described in detail here.

[0198] The remaining contents of this embodiment can be referred to the contents of Embodiment 2 above, and will not be repeated in this embodiment.

[0199] Example 5

[0200] In order to execute the methods corresponding to Embodiments 1 and 2 above and achieve the corresponding functions and technical effects, a defense system against brute-force attacks on traffic is provided below. This system includes:

[0201] The acquisition module is used to acquire network traffic;

[0202] The analysis module is used to analyze the suspiciousness of brute-force attacks on network traffic and obtain the analysis results;

[0203] The gateway sending module is used to send a receive signal to the terminal device based on the analysis results, so that the terminal device can receive network traffic;

[0204] The gateway receiving module is used to receive the set of program names generated by the terminal device based on network traffic;

[0205] The defense module is used to defend against brute-force attacks based on a set of program names.

[0206] The terminal receiving module is used to receive signals from the security gateway; it is also used to receive network traffic based on the received signals.

[0207] The generation module is used to query connection information based on network traffic and generate a set of program names.

[0208] The terminal sending module is used to send a set of program names to the security gateway, so that the security gateway can defend against brute-force attacks based on the set of program names.

[0209] Example 6

[0210] This application provides an electronic device, including a memory and a processor. The memory stores a computer program, and the processor runs the computer program to enable the electronic device to perform the brute-force attack defense method of Embodiment 1.

[0211] Alternatively, the aforementioned electronic device may be a server.

[0212] Please see Figure 5 , Figure 5 This is a schematic diagram illustrating the structural composition of an electronic device provided in an embodiment of this application. The electronic device may include a processor 51, a communication interface 52, a memory 53, and at least one communication bus 54. The communication bus 54 is used to enable direct communication between these components. In this embodiment, the communication interface 52 is used for signaling or data communication with other node devices. The processor 51 may be an integrated circuit chip with signal processing capabilities.

[0213] The processor 51 described above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor, or the processor 51 can be any conventional processor.

[0214] The memory 53 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc. The memory 53 stores computer-readable instructions. When these computer-readable instructions are executed by the processor 51, the device can perform the aforementioned operations. Figure 1 The various steps involved in the method implementation examples.

[0215] Optionally, the electronic device may also include a storage controller and an input / output unit. The memory 53, storage controller, processor 51, peripheral interface, and input / output unit are electrically connected directly or indirectly to each other to achieve data transmission or interaction. For example, these components can be electrically connected to each other via one or more communication buses 54. The processor 51 is used to execute executable modules stored in the memory 53, such as software function modules or computer programs included in the device.

[0216] Input / output units are used to enable users to create tasks and set optional start periods or preset execution times for those tasks, facilitating user-server interaction. Input / output units can be, but are not limited to, a mouse and keyboard.

[0217] Understandable. Figure 5 The structure shown is for illustrative purposes only; the electronic device may also include components that are more advanced than those shown. Figure 5 The more or fewer components shown, or having the same Figure 5 The different configurations shown. Figure 5The components shown can be implemented using hardware, software, or a combination thereof.

[0218] In addition, this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method for defending against brute-force attacks on traffic as described in Embodiment 1.

[0219] This application also provides a computer program product that, when run on a computer, causes the computer to perform the method described in the method embodiment.

[0220] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative; for example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using dedicated hardware-based apparatus that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0221] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0222] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, external hard drives, ROM, RAM, magnetic disks, or optical disks.

[0223] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0224] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of protection of the claims.

[0225] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method for defending against brute-force attacks on network traffic, characterized in that, For use in a security gateway, the method includes: Obtain network traffic; The network traffic was subjected to a brute-force attack suspicion analysis, and the analysis results were obtained. Based on the analysis results, a receive signal is sent to the terminal device so that the terminal device can receive the network traffic; Receive the set of program names generated by the terminal device based on the network traffic; Defense against brute-force attacks based on the set of program names; The steps for performing brute-force attack suspicion analysis on the network traffic and obtaining analysis results include: Perform brute-force analysis on the network traffic; If the network traffic is normal traffic, the five-tuple information of the network traffic will be used as the analysis result; If the network traffic is suspicious, obtain the port information of the network traffic and send the port information to the terminal device so that the terminal device returns the program name corresponding to the port information; The steps for defending against brute-force attacks based on the set of program names include: The set of program names is recorded in a pre-built login program table and a pre-built list of frequently used logins; Defense against brute-force attacks is based on a login program table that records the set of program names and a list of commonly used logins. The step of defending against the brute-force attack based on the login program table recording the set of program names and the frequently used login list includes: Receive the program name corresponding to the port information sent from the terminal device; Based on the port information, query the login program table and the frequently used login list that record the program name set to see if the program name corresponding to the port information is included; If so, a receive signal is sent to the terminal device so that the terminal device receives network traffic for the program name corresponding to the port information; If not, issue an alarm message to defend against network traffic to the program name corresponding to the port information.

2. The method for defending against brute-force attacks on traffic according to claim 1, characterized in that, The step of recording the set of program names into a pre-built login program table and a pre-built frequently used login list includes: The program names in the program name set are recorded sequentially into the pre-built login program table; The login program table corresponding to each recorded program name is updated to obtain the current record count; Determine whether the current record count has reached the record threshold; If so, add the program name corresponding to the current number of records to the pre-built list of frequently used logins.

3. The method for defending against brute-force attacks on traffic according to claim 1, characterized in that, Prior to the step of acquiring network traffic, the following is also included: Receive operational information from the terminal device; Generate response information based on the operational information; The response information is sent to the terminal device to ensure that the terminal device operates normally.

4. A security gateway, characterized in that, The security gateway includes: The acquisition module is used to acquire network traffic; The analysis module is used to perform brute-force attack suspicion analysis on the network traffic and obtain analysis results; The gateway sending module is used to send a receiving signal to the terminal device based on the analysis results, so that the terminal device can receive the network traffic; The gateway receiving module is used to receive the set of program names generated by the terminal device based on the network traffic; A defense module is used to defend against the brute-force attack based on the set of program names; The analysis module is also used for: Perform brute-force analysis on the network traffic; If the network traffic is normal traffic, the five-tuple information of the network traffic will be used as the analysis result; If the network traffic is suspicious, obtain the port information of the network traffic and send the port information to the terminal device so that the terminal device returns the program name corresponding to the port information; The defense module is also used for: The set of program names is recorded in a pre-built login program table and a pre-built list of frequently used logins; Defense against brute-force attacks is based on a login program table that records the set of program names and a list of commonly used logins. Receive the program name corresponding to the port information sent from the terminal device; Based on the port information, query the login program table and the frequently used login list that record the program name set to see if the program name corresponding to the port information is included; If so, a receive signal is sent to the terminal device so that the terminal device receives network traffic for the program name corresponding to the port information; If not, issue an alarm message to defend against network traffic to the program name corresponding to the port information.

5. An electronic device, characterized in that, The device includes a memory and a processor, the memory being used to store a computer program, and the processor running the computer program to cause the electronic device to perform a method for defending against brute-force attacks on traffic according to any one of claims 1 to 3.

6. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements a method for defending against brute-force attacks on traffic as described in any one of claims 1 to 3.

Images