A violent cracking prevention method, a terminal device and a storage medium

Abstract

The present application relates to a kind of violent cracking prevention method, terminal equipment and storage medium, the method includes: S1: configuration security policy;S2: according to the protocol resolution mode corresponding to the configured security policy, the protocol is parsed, and the corresponding login information is obtained;S3: based on the security policy configured and the login information parsed, different violent cracking prevention algorithms are used for real-time detection respectively, to judge whether it is cracked by violence.The present application combines multiple detection algorithms, which can effectively improve the ability of server to prevent violent cracking, and timely alarm the user in the form of detecting violent cracking behavior and intercepting the attacker.

Description

Technical Field

[0001] This invention relates to the field of computer security technology, and in particular to a method, terminal device and storage medium for preventing brute-force attacks. Background Technology

[0002] With the development of the Internet, a large number of user-friendly hacking tools have emerged, significantly lowering the barrier to entry for any hacking attack method. Creating brute-force cracking tools has become extremely easy. Brute-force cracking software is not technically sophisticated; its principle is to try passwords one after another until the correct password is found. However, this method has a low success rate and is time-consuming. In the actual network environment, many servers, despite having multiple layers of security protection, can still be quickly breached by attackers using brute-force attacks after simply adjusting their attack methods.

[0003] Existing server protection against brute-force attacks primarily employs the following methods:

[0004] 1) Limiting bandwidth narrows the network from the outside in, delaying the attacker's cracking process;

[0005] 2) Set security policies to limit connection frequency and define the number of times the same user can connect within a specific time period. If this limit is exceeded, the connection will be rejected.

[0006] 3) Set a security policy to limit the number of incorrect attempts. If a user's password attempts exceed the specified number, the user's connection will be temporarily denied.

[0007] Based on the aforementioned anti-brute-force attack methods, attackers often launch distributed brute-force attacks on the target, using multiple zombie computers to attack the target simultaneously and controlling a certain attack frequency, which makes it more difficult to limit brute-force attacks. Summary of the Invention

[0008] To address the aforementioned problems, this invention proposes a method, terminal device, and storage medium to prevent brute-force attacks.

[0009] The specific plan is as follows:

[0010] A method to prevent brute-force attacks includes the following steps:

[0011] S1: Configure security policies;

[0012] S2: Parse the protocol according to the protocol parsing method corresponding to the configured security policy to obtain the corresponding login information;

[0013] S3: Based on the configured security policy and the parsed login information, different anti-brute-force attack algorithms are used for real-time detection to determine whether a brute-force attack has occurred.

[0014] Furthermore, security policies are configured on the client side by configuring them in the cloud and then downloading them to the client.

[0015] Furthermore, the security policy includes: configuring the listening port, configuring the time period, configuring the threshold for the number of failed login attempts, configuring the time period for distributed attacks, configuring the number of failed login attempts for distributed attacks, configuring whether to issue an alarm, configuring whether to block and the duration of blocking, and configuring the protocol parsing method.

[0016] Furthermore, the protocol parsing methods include packet capture mode and log mode;

[0017] The packet capture parsing process includes: establishing a raw socket, setting BPF filter rules on the raw socket, parsing the network packet header to obtain the data type, capturing network packets with data types 0x0800 and 0x86dd, and parsing the captured network packets to extract login information.

[0018] The log parsing process includes: obtaining the service's log file storage path through the service's configuration file; parsing the obtained log file and extracting login information.

[0019] Furthermore, the login information includes the login username, source IP address, source port, destination IP address, and destination port.

[0020] Furthermore, anti-brute-force algorithms include anti-brute-force algorithms for a single attacker, comprising the following steps:

[0021] S301: Based on the configured security policy and the parsed login information, extract the following parameters: time period, failed login count threshold, login username, source IP address, and source port;

[0022] S302: Construct two cache dictionary tables: Dictionary table 1 with source IP and port as key and login username as value, and dictionary table 2 with source IP as key and login username and login count as value;

[0023] S303: Clean up the data in dictionary table 2 periodically according to the time intervals corresponding to the time periods;

[0024] S304: Based on the parsed login information, check if there exists a key in dictionary table 1 that is the source IP port in the login information. If it exists, update the corresponding value to the login username in the login information; otherwise, add the source IP port in the login information as the key and the login username in the login information as the value to dictionary table 1.

[0025] S305: Based on the parsed login information, check if there exists a key in dictionary table 2 that is the source IP in the login information. If it exists, increment the login count of the corresponding login username in the value by 1, and proceed to S316; otherwise, add the source IP in the login information as the key and the login count of the login username in the value as 1 to dictionary table 2, and proceed to S316.

[0026] S306: Determine whether the number of login attempts for the username corresponding to the source IP in the login information in dictionary table 2 is greater than the threshold for failed login attempts. If so, generate an alarm and block the login.

[0027] Furthermore, the alert information includes: the time of the brute-force attack, the login username, the attacker's IP address, the attacker's port, the victim's IP address, and the victim's port.

[0028] Furthermore, the source IP address in the login information is obtained, and the blocking rule for that IP address is written into the system firewall policy. Based on the set blocking duration, the system firewall policy is queried periodically. When the blocking duration is met, the blocking rule for that IP address is deleted from the firewall policy, thus achieving the purpose of unblocking.

[0029] Furthermore, the anti-brute-force attack algorithm includes an anti-brute-force attack algorithm for distributed attackers, including: extracting parameters based on the configured security policy: time period and failed login count threshold; determining whether there are multiple IPs whose total failed login counts exceed the failed login count threshold within the time period, and if so, generating an alarm and blocking the attack.

[0030] Furthermore, the anti-brute-force attack algorithm includes a distributed attacker anti-brute-force attack algorithm, which includes: caching the currently acquired failed login logs according to IP address; when a set time threshold is reached, reading all failed login logs for each IP address from the cache and identifying whether it is a brute-force attack according to a single attacker brute-force attack detection algorithm.

[0031] A brute-force protection terminal device includes a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the method described above in the embodiments of the present invention.

[0032] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method described above in the embodiments of the present invention.

[0033] The present invention adopts the above technical solution, which can detect brute-force attacks in a timely manner and notify users by combining multiple detection methods and algorithms, and automatically block attackers. Attached Figure Description

[0034] Figure 1 The diagram shown is a flowchart of Embodiment 1 of the present invention.

[0035] Figure 2 The diagram shows the flowchart of the anti-brute-force algorithm for a single attacker in this embodiment.

[0036] Figure 3 The diagram shown is a flowchart of the anti-brute-force attack algorithm for distributed attackers in this embodiment. Detailed Implementation

[0037] To further illustrate the various embodiments, the present invention provides accompanying drawings. These drawings are part of the disclosure of the present invention, primarily used to illustrate the embodiments, and can be used in conjunction with the relevant descriptions in the specification to explain the operating principles of the embodiments. With reference to these drawings, those skilled in the art should be able to understand other possible implementations and the advantages of the present invention.

[0038] The present invention will now be further described in conjunction with the accompanying drawings and specific embodiments.

[0039] Example 1:

[0040] This invention provides a method for preventing brute-force attacks, such as... Figure 1 As shown, the method includes the following steps:

[0041] S1: Configure security policies.

[0042] In this embodiment, the security policy is configured on the client side by configuring it in the cloud and then downloading it to the client, which allows for convenient configuration on multiple clients at the same time.

[0043] The security policy configured in this embodiment includes:

[0044] ■ Configure listening ports: Configure service ports. Multiple service ports can be listened to simultaneously for packet capture and analysis, which can be adapted to host and Docker environments;

[0045] ■Configure Time Period: Configure the connection duration for the same user within a specific time period;

[0046] ■ Configure the threshold for the number of failed login attempts: Configure the threshold for the number of times the same user fails to log in. If the number of failed login attempts exceeds the threshold, the login will be blocked.

[0047] ■ Configure Distributed Attack Time Period: Configure the connection duration within a specific time period for distributed attacks;

[0048] ■ Configure the number of failed login attempts for distributed attacks: Configure the number of times a user fails to log in, for use in distributed attacks;

[0049] ■Configure whether to issue an alarm: When a brute-force attack is detected, the user can choose from a variety of alarm methods, including logs, SMS, email, etc.;

[0050] ■Configure whether to block and the blocking duration: When brute-force attacks are detected, the system will block the IP address that is performing the brute-force attack for a certain period of time, after which the IP address will be unblocked;

[0051] ■Configure protocol parsing method: You can use either packet capture mode or log mode for parsing.

[0052] S2: Parse the protocol according to the protocol parsing method corresponding to the configured security policy to obtain the corresponding login information.

[0053] Depending on the configured protocol parsing method, this embodiment supports both packet capture mode and log mode for parsing. These two parsing methods can handle different system environments. When the network environment is relatively simple and the system response requirements are high, packet capture mode can be used; when the network environment is complex and the system response requirements are low, log mode can be used.

[0054] (1) Packet capture mode

[0055] ■ Create a raw socket, set up BPF filter rules (i.e., configure the listening port) on the raw socket, parse the network packet header to obtain the data type, and capture network packets with data types 0x0800 and 0x86dd;

[0056] ■ Parse captured network packets to extract login information. Login information includes the login username, source IP address, source port, destination IP address, and destination port.

[0057] (2) Log mode

[0058] ■ Obtain the service's log file storage path through the service's configuration file;

[0059] ■ Real-time parsing of acquired log files to extract login information.

[0060] S3: Based on the configured security policy and the parsed login information, different anti-brute-force attack algorithms are used for real-time detection to determine whether a brute-force attack has occurred.

[0061] This embodiment provides two anti-brute-force attack algorithms: one for single attackers and one for distributed attackers. This embodiment combines these two algorithms for real-time detection, achieving high computational power and low latency, effectively improving the system's anti-brute-force attack capabilities.

[0062] (1) As Figure 2As shown, the anti-brute-force algorithm for a single attacker includes the following steps:

[0063] S301: Based on the configured security policy and the parsed login information, extract the following parameters: time period, failed login count threshold, login username, source IP address, and source port;

[0064] S302: Construct two cache dictionary tables: Dictionary table 1 with source IP and port as key and login username as value, and dictionary table 2 with source IP as key and login username and login count as value;

[0065] S303: Clean up the data in dictionary table 2 periodically according to the time intervals corresponding to the time periods;

[0066] S304: Based on the parsed login information, check if there exists a key in dictionary table 1 that is the source IP port in the login information. If it exists, update the corresponding value to the login username in the login information; otherwise, add the source IP port in the login information as the key and the login username in the login information as the value to dictionary table 1.

[0067] S305: Based on the parsed login information, check if there exists a key in dictionary table 2 that is the source IP in the login information. If it exists, increment the login count of the corresponding login username in the value by 1, and proceed to S316; otherwise, add the source IP in the login information as the key and the login count of the login username in the value as 1 to dictionary table 2, and proceed to S316.

[0068] S306: Determine whether the number of login attempts for the username corresponding to the source IP in the login information in dictionary table 2 is greater than the threshold for failed login attempts. If so, generate an alarm and block the login.

[0069] (2)Reference Figure 3 The main process of a distributed attacker's anti-brute-force algorithm is as follows:

[0070] Distributed brute-force attacks can launch attacks on a target server from multiple computers within a short period. Attackers, in order to bypass security policies, control the attack frequency, for example, each computer attacking every few seconds. This can render a single attacker's brute-force prevention algorithm ineffective. In practice, this generates a large number of failed login logs from different IPs within a short time, and these logs recur at regular intervals. Therefore, when detecting data, if the total number of failed login attempts from multiple IPs exceeds a set threshold within a set time period, it can be considered a distributed brute-force attack, triggering an alert and blocking the attack. However, if the attacker controls the intensity of the distributed brute-force attack (i.e., the number of attacking computers) and uses multiple usernames to simultaneously brute-force, the threshold for the total number of failed login attempts from multiple IPs may not be reached. Therefore, it is necessary to cache the currently acquired failed login logs by IP address. When a set time threshold is reached, all failed login logs for each IP are read from the cache, and the brute-force attack detection algorithm for a single attacker is used to identify whether it is a brute-force attack.

[0071] When the system detects brute-force attacks, it can promptly notify the user via alert logs, SMS, email, etc., depending on the user's configuration. The alert content includes detailed information such as the time the brute-force attack occurred, the login username, the attacker's IP address, the attacker's port, the victim's IP address, and the victim's port.

[0072] When the system detects brute-force attacks, it can block and intercept the attacker based on the user's configuration. The main steps are as follows:

[0073] ■ Obtain the attacker's IP address, i.e., the source IP address in the login information, and write the blocking rule for that IP address into the system firewall policy;

[0074] ■ Based on the set blocking duration, the system firewall policy is queried periodically. Once the blocking duration is met, the rule for that IP address is deleted from the firewall policy, thus achieving the purpose of unblocking.

[0075] The embodiments of this invention combine multiple detection algorithms to effectively improve the server's ability to prevent brute-force attacks. After detecting brute-force attacks, it can promptly alert users and intercept attackers, and the entire process can be automated, meeting the current market demand for this type of product.

[0076] Example 2:

[0077] The present invention also provides a brute-force anti-cracking terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps in the method embodiment described above in Embodiment 1 of the present invention.

[0078] Furthermore, as an executable solution, the anti-brute-force attack terminal device can be a computing device such as a desktop computer, laptop, handheld computer, or cloud server. The anti-brute-force attack terminal device may include, but is not limited to, a processor and memory. Those skilled in the art will understand that the above-described structure of the anti-brute-force attack terminal device is merely an example and does not constitute a limitation on the anti-brute-force attack terminal device. It may include more or fewer components than described above, or combine certain components, or different components. For example, the anti-brute-force attack terminal device may also include input / output devices, network access devices, buses, etc., and this embodiment of the invention does not limit this.

[0079] Furthermore, as an executable solution, the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the anti-brute-force attack terminal device, connecting various parts of the device via various interfaces and lines.

[0080] The memory can be used to store the computer programs and / or modules. The processor implements various functions of the anti-brute-force terminal device by running or executing the computer programs and / or modules stored in the memory and calling the data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system and at least one application program required for a function; the data storage area may store data created based on the use of the mobile phone. In addition, the memory may include high-speed random access memory and may also include non-volatile memory, such as hard disk, RAM, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0081] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the method described in the embodiments of the present invention.

[0082] If the modules / units integrated into the anti-brute-force terminal device are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), and software distribution media, etc.

[0083] Although the invention has been specifically shown and described in conjunction with preferred embodiments, those skilled in the art should understand that various changes in form and detail may be made to the invention without departing from the spirit and scope of the invention as defined in the appended claims, all of which shall be within the scope of protection of the invention.

Claims

1. A method of preventing brute force attacks, characterized by, Comprising the following steps: S1: configuring a security policy; S2: parsing the protocol according to the protocol parsing mode corresponding to the configured security policy to obtain corresponding login information; S3: based on the configured security policy and the parsed login information, different anti-brute-force cracking algorithms are used for real-time detection to judge whether it is brute-forced cracked or not; The anti-brute-force cracking algorithm includes a single attacker anti-brute-force cracking algorithm, comprising the following steps: S301: based on the configured security policy and the parsed login information, the following parameters are extracted: time period, failure login number threshold, login username, source IP address and source IP port; S302: two cache dictionary tables are constructed, respectively: dictionary table 1 with source IP port as key and login username as value, and dictionary table 2 with source IP as key and login username login number as value; S303: according to the time interval corresponding to the time period, the data of dictionary table 2 is cleaned up regularly; S304: based on the parsed login information, it is checked in dictionary table 1 whether there is a key as the source IP port in the login information, if there is, the corresponding value is updated as the login username in the login information; otherwise, the source IP port in the login information is taken as the key, and the login username in the login information is added to dictionary table 1 as the value; S305: based on the parsed login information, it is checked in dictionary table 2 whether there is a key as the source IP in the login information, if there is, the login username login number in the corresponding value is added by 1, and S306 is entered; otherwise, the source IP in the login information is taken as the key, and the value of the login username login number in the value is set to 1, and then added to dictionary table 2, and S306 is entered; S306: it is judged whether the login username login number corresponding to the source IP in the login information in dictionary table 2 is greater than the failure login number threshold, if yes, an alarm is generated and intercepted; The anti-brute-force cracking algorithm includes a distributed attacker anti-brute-force cracking algorithm, which comprises: based on the configured security policy, the parameters of time period and failure login number threshold are extracted; it is judged whether there are multiple IPs in the time period whose total failure login number is greater than the failure login number threshold, if yes, an alarm is generated and intercepted; The anti-brute-force cracking algorithm includes a distributed attacker anti-brute-force cracking algorithm, which comprises: the current obtained failure login log is classified and cached according to IP, when a set time threshold is reached, all failure login logs of each IP are read from the cache, and whether it is brute-forced cracked is identified according to the single attacker brute-force cracking detection algorithm.

2. The method of claim 1, wherein: The security policy is configured on the cloud and then downloaded to the client for configuration on the client.

3. The method of claim 1, wherein: The security policy includes: configuring a listening port, configuring a time period, configuring a failure login number threshold, configuring a distributed attack time period, configuring a distributed attack failure login number, configuring whether to alarm, configuring whether to intercept and intercept duration, configuring protocol parsing mode.

4. The method of claim 1, wherein: The protocol parsing mode includes packet capture mode and log mode; The analysis process of the packet capture mode includes: establishing a raw socket, setting a bpf filter rule on the raw socket, analyzing a network packet header to obtain a data type, and capturing network packets with data types of 0x0800 and 0x86dd; analyzing the captured network packets, and extracting login information. The analysis process of the log mode includes: obtaining a log file storage path of a service through a configuration file of the service; analyzing the obtained log file, and extracting login information.

5. The method of claim 1, wherein: The login information includes a login username, a source IP address, a source IP port, a destination IP address, and a destination port.

6. The method of claim 1, wherein: The content of the alarm includes: a brute force cracking behavior generation time, a login username, an attacker IP address, an attacker port, an attacked IP address, and an attacked port.

7. The method of claim 1, wherein: The interception mode is: obtaining a source IP address in login information, writing the source IP address interception rule into a system firewall policy, and querying the system firewall policy at a set interception time length, and deleting the source IP address interception rule from the firewall policy when the interception time length is met, so as to achieve unblocking.

8. A terminal device resistant to brute force attacks, characterized by: A computer program product comprising a processor, a memory, and a computer program stored in the memory and running on the processor, wherein the processor implements the steps of the method according to any one of claims 1-7 when running the computer program.

9. A computer readable storage medium storing a computer program, characterized in that: The computer program is executed by the processor to implement the steps of the method according to any one of claims 1-7.

Images