Cracking behavior detection method and device, electronic equipment and storage medium

Abstract

The application provides a cracking behavior detection method and device, electronic equipment and storage medium, and relates to the technical field of computer security. The method comprises the following steps: in the case that the application layer protocol of the current session is determined to be a secure shell protocol, obtaining target data packets in an encrypted communication stage from a server device in the current session; in the case that the cumulative number of the obtained target data packets is less than a preset number, and the length of each target data packet is the same, determining that the current session has a cracking behavior. Since each data packet generated by the server device has the characteristics of continuity and the same length when the current session has a cracking behavior, the number of data packets in the encrypted communication stage from the server device and the length of each data packet are statistically analyzed and judged. In the case of meeting the judgment condition, it is determined that the current session has a cracking behavior, which can effectively detect the cracking behavior.

Description

Technical Field

[0001] This invention relates to the field of computer security technology, and in particular to a method, apparatus, electronic device, and storage medium for detecting hacking behavior. Background Technology

[0002] In computer networks, various types of network attacks exist, with brute-force attacks being a common one. Attackers use brute-force software, password dictionaries, or brute-force password guessing to attempt to crack passwords for specific network services. Successful brute-force attacks can cause harm to the victim.

[0003] Under traditional network protocols such as File Transfer Protocol (LTP) and Simple Mail Transfer Protocol (SMPP), data is transmitted in plaintext over the network. Network security devices deployed in the network can parse protocol data packets to obtain login status codes, determine whether a user account has successfully logged in, and thus detect whether brute-force attacks against these protocols have occurred on the network.

[0004] Secure Shell (SSH) is an application-layer protocol for secure remote login and other secure network services over insecure networks. The user login process uses encrypted data transmission. Security devices deployed on the network cannot parse encrypted login packets; therefore, existing technologies cannot detect brute-force attacks against Secure Shell. Detecting attacks against Secure Shell has become a pressing issue. Summary of the Invention

[0005] To address the problems in the prior art, embodiments of the present invention provide a method, apparatus, electronic device, and storage medium for detecting hacking behavior.

[0006] For example, embodiments of the present invention provide the following technical solutions:

[0007] In a first aspect, embodiments of the present invention provide a method for detecting hacking behavior, including:

[0008] If the application layer protocol of the current session is determined to be Secure Shell protocol, the target data packet from the server device in the current session that is in the encrypted communication stage is obtained;

[0009] If the cumulative number of the acquired target data packets is less than a preset number, and the length of each target data packet is the same, it is determined that the current session has been compromised.

[0010] Further, obtaining the target data packet in the encrypted communication stage from the server device in the current session includes:

[0011] Obtain the current data packet in the encrypted communication phase of the current session;

[0012] If it is determined that the current data packet is the first data packet from the client device, the next data packet in the current session that is in the encrypted communication stage is obtained, and the next data packet is determined as the target data packet;

[0013] The step of determining that the current session has been compromised when the cumulative number of the acquired target data packets is less than a preset number and all the target data packets have the same length includes:

[0014] If it is determined that the target data packet is a data packet from the server device, update the cumulative number of data packets from the server device that are in the encrypted communication stage;

[0015] If the updated cumulative number is less than the preset number and the length of the target data packet is less than the preset length, the length of the target data packet is recorded in the length sequence, and a new data packet in the current session that is in the encrypted communication stage is obtained, and the new data packet is used as the new target data packet.

[0016] If it is determined that the length of a predetermined number of consecutive target data packets in the length sequence is the same, it is determined that the current session is experiencing hacking behavior.

[0017] Furthermore, determining that the application layer protocol of the current session is the Secure Shell protocol includes:

[0018] The network data packets from the server device in the current session are obtained through the mirror interface;

[0019] The application layer protocol data of the network data packets is matched with the Secure Shell protocol identification rules;

[0020] Upon successful matching, the application layer protocol of the current session is determined to be the Secure Shell protocol.

[0021] Furthermore, the current data packet is a data packet in the encrypted communication stage of the current session obtained from the application layer message, and the application layer message is a message obtained by reassembling a continuous target TCP data packet in the direction of the first data packet into a TCP stream.

[0022] Furthermore, determining that the current session exhibits hacking behavior when the length of a predetermined number of consecutive target data packets in the length sequence is all the same includes:

[0023] If it is determined that the length of a consecutive preset number of target data packets in the length sequence is the target length, the preset number of abnormal occurrences is determined as the number of abnormal logins; the preset number of abnormal occurrences is the difference between the preset number and a first number; the first number is the number of data packets of the target length sent by the server device to the client device before login;

[0024] If the length of the next data packet after determining the length of a predetermined number of consecutive target data packets in the length sequence is the target length, then the target abnormal login count is determined based on the abnormal login count; the target abnormal login count is the current total number of abnormal logins in the current session.

[0025] If the number of abnormal login attempts exceeds a preset number, it is determined that the current session involves hacking behavior.

[0026] Further, determining the target number of abnormal logins based on the number of abnormal logins includes:

[0027] If a login entry corresponding to the current session is found in the login record table, the target abnormal login count is determined based on the number of abnormal logins and the number of logins corresponding to the login entry; the login entry is used to count the number of abnormal logins from the client device to the server device in the current session;

[0028] If no login entry corresponding to the current session is found in the login record table, the login entry is created, the number of abnormal logins is determined as the target number of abnormal logins, and the target number of abnormal logins is stored in correspondence with the login entry.

[0029] Furthermore, determining that the current session exhibits hacking behavior when the number of abnormal login attempts exceeds a preset number includes:

[0030] Obtain the creation time of the login entry;

[0031] If the time interval between the current moment and the creation moment is less than or equal to a preset duration, and the number of abnormal login attempts is greater than or equal to the preset number, then the current session is determined to have a hacking behavior.

[0032] Furthermore, the method also includes:

[0033] If the time interval is greater than the preset duration, and / or the number of abnormal login attempts is less than the preset number, it is determined that the current session does not involve any hacking behavior.

[0034] Secondly, embodiments of the present invention also provide a hacking behavior detection device, comprising:

[0035] The acquisition unit is used to acquire target data packets from the server device in the encrypted communication stage in the current session when it is determined that the application layer protocol of the current session is the Secure Shell protocol.

[0036] The determining unit is configured to determine that the current session has a cracking behavior when the cumulative number of the acquired target data packets is less than a preset number and the length of each target data packet is the same.

[0037] Thirdly, embodiments of the present invention also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the cracking behavior detection method as described in the first aspect.

[0038] Fourthly, embodiments of the present invention also provide a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the cracking behavior detection method as described in the first aspect.

[0039] Fifthly, embodiments of the present invention also provide a computer program product having executable instructions stored thereon, which, when executed by a processor, cause the processor to implement the cracking behavior detection method as described in the first aspect.

[0040] The present invention provides a method, apparatus, electronic device, and storage medium for detecting botnetting. The method, when determining that the application layer protocol of the current session is the Secure Shell protocol, acquires target data packets from the server device in the encrypted communication phase of the current session. If the cumulative number of acquired target data packets is less than a preset number, and all target data packets have the same length, it determines that botnetting behavior exists in the current session. Since the data packets generated by the server device have continuous and identical lengths when botnetting behavior exists in the current session, this invention statistically analyzes and judges the number of data packets from the server device in the encrypted communication phase and the length of each data packet. When the cumulative number of data packets is less than a preset number, it can be determined that the target data packets are all generated during the authentication phase. When the length of each target data packet is the same, it can be determined that each target data packet is generated when authentication fails. Therefore, when the judgment conditions are met, it is determined that botnetting behavior exists in the current session, effectively detecting botnetting behavior. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 This is a flowchart illustrating the cracking behavior detection method provided in an embodiment of the present invention;

[0043] Figure 2 This is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention;

[0044] Figure 3 This is a schematic diagram of the structure of the cracking behavior detection device provided in an embodiment of the present invention;

[0045] Figure 4 This is a schematic diagram of the physical structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0047] It should be noted that the serial numbers assigned to the objects described in this invention, such as "first" and "second", are only used to distinguish the objects being described and do not have any sequential or technical meaning.

[0048] Brute-force attacks are a type of network service breach and a common network attack method. When using brute-force attacks, a large number of login failures occur within a short time interval, and these failures occur consecutively. Therefore, the server device generates continuous data packets of the same length. By utilizing the continuity and identical length of these data packets during the breach, it is possible to detect the presence of brute-force attacks on the network while maintaining a secure outer shell protocol for encrypted data transmission.

[0049] Based on this, embodiments of the present invention provide a method for detecting botnetting behavior. This method, when determining that the application layer protocol of the current session is the Secure Shell protocol, acquires target data packets from the server device in the encrypted communication stage of the current session. If the cumulative number of acquired target data packets is less than a preset number, and the length of each target data packet is the same, it is determined that the current session exhibits botnetting behavior. Since the data packets generated by the server device have continuous and identical lengths when botnetting behavior exists in the current session, the present invention statistically analyzes and judges the number of data packets from the server device in the encrypted communication stage and the length of each data packet. When the judgment conditions are met, it determines that the current session exhibits botnetting behavior, effectively detecting botnetting behavior. The following is in conjunction with… Figure 1 and Figure 2 The cracking behavior detection method provided in the embodiments of the present invention is described.

[0050] Figure 1 This is a flowchart illustrating the cracking behavior detection method provided in this embodiment of the invention. The execution subject of this embodiment of the invention can be an electronic device such as a computer, server, or server cluster, or a cracking behavior detection device installed in the electronic device or smart device. The cracking behavior detection device can be implemented by software, hardware, or a combination of both.

[0051] Figure 2 This is a schematic diagram of the structure of the electronic device provided in the embodiment of the present invention, such as... Figure 2 As shown, the electronic device includes a traffic acquisition module, a Secure Shell protocol identification module, a TCP (Transmission Control Protocol) stream reassembly module, a Secure Shell protocol parsing module, a login behavior identification module, and a brute-force attack detection module. The brute-force attack detection method provided in this embodiment of the invention can be implemented through the modules in the above-mentioned electronic device.

[0052] like Figure 1 As shown, the cracking behavior detection method includes the following steps 110 to 120.

[0053] Step 110: If the application layer protocol of the current session is determined to be Secure Shell protocol, obtain the target data packet from the server device in the encrypted communication stage in the current session.

[0054] For example, an electronic device is connected to a switch via a mirror interface. The traffic acquisition module can be a bypass network packet sniffer, which can obtain network packets from the switches participating in the network service. After sniffing, the network packets can be parsed at a high level, recording information such as connection status and application layer protocols.

[0055] After acquiring the network data packets of the current session through the traffic acquisition module, and assuming the application layer protocol of the current session is Secure Shell, the system can determine whether any unauthorized actions have occurred within the network service under this Secure Shell protocol by parsing and analyzing the network data packets. Such unauthorized actions could include, for example, brute-force attacks used to gain unauthorized user login.

[0056] When a user logs into the server device, at least a portion of the data packets in the encrypted communication phase are generated during the authentication phase. Unauthorized user logins and other cracking behaviors are mainly behaviors during the authentication phase. Therefore, by acquiring target data packets in the encrypted communication phase of the current session and analyzing them, and after identifying data packets that are in the authentication phase, the length characteristics of the data packets are detected to determine whether the login behavior in this authentication phase is legitimate. If it is determined to be an illegitimate login behavior, then the behavior is determined to be a cracking behavior, which means that cracking behavior can be detected in the current session.

[0057] Optionally, the traffic acquisition module can internally set up a session table, with session entries in the table to record connection status information. The session table could be, for example, a hash table, where each session entry represents a data stream. Each session entry contains various information uniquely identifying a data stream, such as: source IP (Internet Protocol) address, destination IP address, source port number, destination port number, transport layer protocol type, and application layer protocol type.

[0058] Step 120: If the cumulative number of target data packets obtained is less than the preset number, and the length of each target data packet is the same, it is determined that the current session has cracking behavior.

[0059] For example, the preset quantity can be a preset threshold for judging the cumulative number of target data packets, or it can be an empirical value set based on experimental data, statistical data, or specific circumstances.

[0060] The cumulative number of target data packets reflects the current stage of the session. It can be understood as determining which sub-stage of the encrypted communication phase the target data packet belongs to by judging the cumulative number of target data packets. These sub-stages can include the session request stage, the interactive session stage, or the authentication stage. When the cumulative number of target data packets is less than a preset number, it can be determined that the target data packet of the current session was generated in the authentication stage of the encrypted communication phase. Length analysis of the target data packets in the authentication stage can determine whether there are consecutive authentication failures during the authentication stage.

[0061] In a cracking attempt, consecutive authentication failures may occur. Each time authentication fails, the server device sends a target data packet indicating the failure. Since each target data packet in the encrypted communication phase from the server device has the same length, it indicates that these target data packets are generated by consecutive authentication failures. If the length of each target data packet is determined to be the same, it can be confirmed that a cracking attempt is occurring in the current session.

[0062] The cracking behavior detection method provided in this invention, when determining that the application layer protocol of the current session is Secure Shell protocol, acquires target data packets from the server device in the encrypted communication stage of the current session; if the cumulative number of acquired target data packets is less than a preset number, and the length of each target data packet is the same, it is determined that cracking behavior exists in the current session. Since when cracking behavior exists in the current session, the data packets generated by the server device have the characteristic of continuous and identical lengths, this invention statistically analyzes and judges the number of data packets from the server device in the encrypted communication stage and the length of each data packet. When the cumulative number of data packets is less than a preset number, it can be determined that the target data packets are all data packets generated during the authentication stage; when the length of each target data packet is the same, it can be determined that each target data packet is a data packet generated when authentication fails. Therefore, when the judgment conditions are met, it is determined that cracking behavior exists in the current session, effectively detecting cracking behavior.

[0063] In one embodiment, acquiring a target data packet from a server device in the encrypted communication stage during the current session includes: acquiring the current data packet in the encrypted communication stage during the current session; if the current data packet is determined to be the first data packet from the client device, acquiring the next data packet in the encrypted communication stage during the current session and identifying the next data packet as the target data packet; if the cumulative number of acquired target data packets is less than a preset number and the length of each target data packet is the same, determining that the current session has a cracking behavior includes: if the target data packet is determined to be a data packet from the server device, updating the cumulative number of data packets from the server device in the encrypted communication stage; if the updated cumulative number is determined to be less than a preset number and the length of the target data packet is less than a preset length, recording the length of the target data packet in a length sequence, acquiring a new data packet in the encrypted communication stage during the current session, and using the new data packet as a new target data packet; if the length of a consecutive preset number of target data packets in the length sequence is the same, determining that the current session has a cracking behavior.

[0064] For example, a login behavior recognition module in an electronic device can be a module that judges and recognizes the behavior of a client device. The login behavior recognition module can determine whether the client device's behavior constitutes a login action. In determining whether a login action is valid, the login behavior recognition module can obtain the judgment result based on the data packet flow direction, the number of data packets, the length of the data packets, and corresponding judgment conditions.

[0065] When the current data packet is the first data packet from the client device, it can be indicated that the current data packet may be an authentication data packet sent by the user from the client device to the server device. Therefore, if it is determined that the current data packet is the first data packet from the client device, the next data packet in the current session that is in the encrypted communication stage is obtained. By analyzing the next data packet, it is determined whether the next data packet is an authentication data packet in the encrypted communication stage.

[0066] For example, when it is determined that the next data packet is from the server device, the next data packet is identified as the target data packet. The number of target data packets from the server device in the encrypted communication stage is updated, that is, the number of target data packets from the server device in the encrypted communication stage is accumulated. When the updated number is greater than or equal to a preset number, it indicates that the data packets from the server device in the encrypted communication stage may be data packets generated in the session request stage or interactive session stage of the encrypted communication stage. These data packets are not data packets generated in the authentication stage, that is, they are not data packets generated by login behavior, and the cracking behavior detection step can be exited. Conversely, when the updated number is less than the preset number, it can be determined that the behavior corresponding to these data packets is a login behavior, but the legitimacy of the login behavior needs to be further determined.

[0067] For example, assuming the current session has processed a total of n_pkts_from_server packets from the server, if n_pkts_from_server is greater than or equal to the preset number max_proc_count, it indicates that these packets were not generated during the authentication phase, i.e., not during login. In this case, the cracking behavior detection step can be exited. max_proc_count can be set based on requirements, for example, it can be set to 10.

[0068] If n_pkts_from_server is less than the preset number max_proc_count, it indicates that these data packets are generated during the authentication phase, i.e., data packets generated by the login action, and the legitimacy of this login action needs to be further determined. In this case, updating the number of data packets from the server device that are in the encrypted communication phase can be expressed as n_pkts_from_server = n_pkts_from_server + 1.

[0069] For example, in the encrypted communication phase, the data content of the data packet is confidential, but the length of the data packet is known information. By analyzing the length of the data packet, it is possible to determine whether the data packet is generated by abnormal login behavior without compromising data confidentiality, thereby identifying the cracking behavior of abnormal login.

[0070] The system acquires target data packets from the server device that are in the encrypted communication phase. It parses the length of these packets and compares it to a preset length. If the target data packet length is less than the preset length, it records the length of the target data packet in a length sequence. The system then acquires new data packets in the current session that are in the encrypted communication phase, treating these new packets as new target data packets. It analyzes these new target data packets using the same steps as above, recording the lengths of packets that meet the criteria in a length sequence. This length sequence can be a sequence storing data packet lengths, arranged in the order they were recorded.

[0071] For example, when parsing the length of a target data packet, if the length of the target data packet is greater than or equal to a preset length, it indicates that the data packet is an authenticated data packet sent by the server device after the login behavior has passed the authentication phase. For example, this target data packet with a length greater than or equal to the preset length may be a data packet carrying a welcome message after the user has successfully logged in. Therefore, if it is determined that the length of the target data packet is greater than or equal to the preset length, this data packet can be ignored, and the server can continue to obtain new target data packets from the server device that are in the encrypted communication phase to determine their length.

[0072] If the length of the new target data packet is less than the preset length, it means that the data packet is an authentication failure data packet sent by the server device when the login behavior fails the authentication stage. The behavior corresponding to this data packet is an abnormal login behavior, and the length of this data packet needs to be recorded in the length sequence. The length of each target data packet that meets the recording conditions can be obtained through this length sequence.

[0073] For example, a preset length can be set to `max_size`, where `max_size` can be a length value set based on requirements, such as 256. When it is determined that the updated quantity is less than the preset quantity `max_proc_count`, it is checked whether the length of the target data packet is less than `max_size`. If it is less than `max_size`, the length of the target data packet is recorded in the length sequence. The process continues to acquire new data packets in the current session that are in the encrypted communication stage, and uses these new data packets as new target data packets to continue detecting and judging the next data packet.

[0074] For example, when a new target data packet length is added to the length sequence, it is necessary to determine whether the number of consecutive identical lengths in the length sequence is equal to a preset number. When it is determined that the number of consecutive identical lengths in the length sequence is equal to the preset number, it can be reflected that these target data packets of the same length are all data packets generated by abnormal login behavior. At this time, it can be determined that the data packets in the current session contain data packets generated by cracking behavior, and it can be determined that there is cracking behavior in the current session.

[0075] The preset quantity can be set based on requirements, such as 2, 3, or 4. The target length is the length of the data packet determined based on the condition of a consecutive preset quantity in the length sequence.

[0076] For example, if the same length appears n times consecutively in a length sequence, the current session is considered potentially abnormal, where n is a preset number, which can be 2 or 3. This n consecutive occurrences of the same length is the target length, which can be recorded as `suspicious_len`. Optionally, if abnormal login behavior is detected in the current session, and the updated number of data packets from the server device in the encrypted communication stage is still based on the previous preset number, it may cause the detection step to fail. Therefore, the preset number needs to be reset. For example, setting the preset number `max_proc_count` to infinity, i.e., setting `max_proc_count = +∞`, will continuously analyze and record the length of new target data packets to further accurately determine the cracking behavior.

[0077] The cracking behavior detection method provided in this invention obtains the current data packets in the encrypted communication phase under the Secure Shell protocol. When the source of the target data packets meets the conditions, the number of target data packets in the encrypted communication phase from the server device is updated. If the updated number is less than a preset number and the length of the target data packets is less than a preset length, the length of the target data packets is recorded in a length sequence. New target data packets in the encrypted communication phase of the current session are obtained and used as the target data packets. If the length of a preset number of consecutive target data packets in the length sequence is the same, cracking behavior is determined to exist in the current session. Since the lengths of the data packets generated by the server device are continuous and the same when cracking behavior exists, this invention counts the number of target data packets in the encrypted communication phase from the server device. When the number is less than a preset number, the length of each target data packet is recorded in a length sequence. If the length of a preset number of consecutive target data packets in the length sequence is the same, cracking behavior is indicated in the current session. In other words, this invention utilizes the continuity and the same length among the data packets generated by the server device during cracking behavior to effectively detect cracking behavior.

[0078] In order to accurately determine whether the application layer protocol of the current session is a Secure Shell protocol, the application layer protocol can be matched based on identification rules. If the match is successful, the application layer protocol of the current session can be determined to be a Secure Shell protocol.

[0079] In one embodiment, determining that the application layer protocol of the current session is the Secure Shell protocol can be achieved in the following ways:

[0080] The network data packets from the server device in the current session are obtained through the mirror interface; the application layer protocol data of the network data packets are matched with the Secure Shell protocol identification rules; if the match is successful, the application layer protocol of the current session is determined to be the Secure Shell protocol.

[0081] For example, an electronic device is connected to a mirror interface of a switch participating in network services. The traffic acquisition module in the electronic device obtains network packets from the server device in the current session through the mirror interface. After obtaining the network packets, high-level parsing is performed on the network packets, and application layer protocol data is recorded.

[0082] A preset Secure Shell protocol identification rule is set up. The parsed application layer protocol data is matched with the Secure Shell protocol identification rule. When the match is successful, the application layer protocol of the current session can be determined to be the Secure Shell protocol.

[0083] For example, a Secure Shell protocol identification module in an electronic device can be used to identify network packets received from a server device to determine whether the application layer protocol of the current session is Secure Shell. The Secure Shell protocol identification module can be a regular expression matcher; for instance, the Hyperscan engine can be used to identify application layer protocol data in network packets. If the application layer protocol data in the network packets matches the Secure Shell protocol identification rules of the Hyperscan engine, then the application layer protocol of the current session can be determined to be Secure Shell.

[0084] Optionally, the Secure Shell Protocol identification rule can be: data packets from the server device to the client device satisfy the regular expression: [Ss][Ss][Hh]-

[12] \\.[0-9]. Here, the data packet from the server device to the client device can be the first data packet from the server device to the client device, or it can be any other data packet from the server device to the client device; this embodiment of the invention does not impose any restrictions on this.

[0085] In one implementation, if it is determined that the application layer protocol of the current session is a Secure Shell protocol, then the application layer protocol type of the current session is recorded as a Secure Shell protocol type in the above session table, and the data stream of the session is input into the TCP stream reassembly module of the electronic device for TCP data reassembly; if it is determined that the application layer protocol of the current session is not a Secure Shell protocol, then the application layer protocol type of the current session is recorded as not being a Secure Shell protocol type in the above session table, and no cracking behavior detection is performed on the session.

[0086] In this embodiment, the network data packets from the server device in the current session are obtained by using the mirror interface, and the network data packets are matched based on the Secure Shell protocol identification rules. This can quickly and accurately determine whether the application layer protocol of the current session is the Secure Shell protocol, thereby improving the efficiency of cracking behavior detection.

[0087] When retrieving the current data packet that is in the encrypted communication phase of the current session, in order to obtain a valid current data packet, the current data packet can be obtained based on the application layer message.

[0088] In one embodiment, the current data packet is a data packet in the encrypted communication stage of the current session obtained from the application layer message, and the application layer message is a message obtained by reassembling a continuous target TCP data packet in the direction of the first data packet into a TCP stream.

[0089] For example, when the current network packet in the current session is obtained, the TCP packets in the current network packet are stored in the flow reassembly list. The flow reassembly list may include TCP packets and reassembly entries corresponding to the TCP packets in the current session. When it is determined that the flow reassembly list includes at least one target TCP packet corresponding to a target reassembly entry, the application layer message can be determined based on the data segment of each target TCP packet, and the current packet in the encrypted communication phase of the current session can be obtained from the application layer message. Each target TCP packet is a consecutive packet in the direction of a first packet; the target reassembly entry can be used to characterize the direction of the first packet.

[0090] The stream reassembly list can store TCP packets and the reassembly entries corresponding to the TCP packets in the current session. Reassembly entries can include the TCP packet's four-tuple, which consists of the source IP address, destination IP address, source port number, and destination port number.

[0091] The target reassembly entry is used to characterize the direction of the first data packet. The direction of the first data packet can be the direction of the data flow between the server device and the client device in the current session. For example, the direction of the first data packet can be the direction of sending data packets from the client device to the server device, or the direction of sending data packets from the server device to the client device.

[0092] When determining that the stream reassembly list includes at least one target TCP packet corresponding to a target reassembly entry, the application layer message can be determined based on the data segment of each target TCP packet. Here, the target TCP packet is the TCP packet corresponding to the target reassembly entry, and the data segment of the target TCP packet is the data in the target TCP packet excluding the TCP header data.

[0093] The application layer message is determined based on the data segments of each target TCP packet. For example, the application layer message can be obtained by concatenating the data portions of the target TCP packet segments. All target TCP packets are consecutive packets in the direction of the first packet. Based on this, the application layer message is obtained, and the current data packets in the encrypted communication phase of the current session can be retrieved from this message.

[0094] It should be noted that when the number of target TCP packets corresponding to the target reassembly entry is 1, the data segment of the target TCP packet is determined as an application layer message; when the number of target TCP packets corresponding to the target reassembly entry is greater than 1, the data segments of each target TCP packet are concatenated to obtain an application layer message.

[0095] In this embodiment, TCP packets in the current network data packet are stored in a flow reassembly list. When it is determined that the flow reassembly list includes a target reassembly entry and its corresponding target TCP packet, the application layer message can be determined based on the data segments of each target TCP packet. Furthermore, the current data packet in the encrypted communication stage of the current session can be obtained from the application layer message. This allows for accurate acquisition of the current data packet in the encrypted communication stage corresponding to the current session, improving the reliability and efficiency of acquiring the current data packet.

[0096] Based on the above embodiments, in order to improve the integrity and accuracy of the obtained application layer messages and further enhance the reliability of obtaining the current data packets, the TCP data packets in the current network data packets can be stored in the flow reassembly list based on preset sorting rules, and the integrity of the TCP data packets can be judged based on the first preset condition and the second preset condition.

[0097] In one embodiment, TCP packets in the current network data packet are stored in a stream reassembly list, which can be implemented in the following way:

[0098] The TCP packets in the current network data packets are stored in the flow reassembly list based on a preset sorting rule; the preset sorting rule is a rule based on the sequence number in the TCP packets; determining that the flow reassembly list includes at least one target TCP packet corresponding to the target reassembly entry includes: determining that the flow reassembly list includes at least one target TCP packet corresponding to the target reassembly entry when the first preset condition and the second preset condition are met.

[0099] The first preset condition is that the sequence numbers in each target TCP packet corresponding to the target reassembly entry are consecutive; the second preset condition is that the next TCP packet obtained is a packet from the direction of the second packet, and / or, the TCP connection is broken; the direction of the second packet is opposite to the direction of the first packet.

[0100] For example, the preset sorting rule can be a rule based on the sequence numbers in the TCP packets, such as arranging them sequentially according to the sequence number values ​​contained in the TCP header data of each TCP packet. When storing the TCP packets in the current network packet in the flow reassembly list, storing them sequentially based on this preset sorting rule can organize each TCP packet and prevent application layer message errors caused by misordered splicing when concatenating data segments from each TCP packet.

[0101] The first preset condition can be used to determine whether the target TCP packets corresponding to the target reassembly entry are out of order, have gaps, or are lost. The second preset condition can be used to determine whether the TCP packets have been received completely. Using the first and second preset conditions, it can be determined whether the acquired target TCP packets have been received completely, or in other words, whether all packets have arrived.

[0102] The direction of the second data packet can be the opposite of the direction of the first data packet. For example, the direction of the first data packet is the direction of sending data packets from the client device to the server device, and the direction of the second data packet is the direction of sending data packets from the server device to the client device.

[0103] For example, after the traffic acquisition module obtains a TCP packet, it extracts the four-tuple of the TCP packet. The TCP stream reassembly module then searches the stream reassembly list for a matching reassembly entry. If a matching entry is found, the TCP packet is placed into its corresponding entry, sorted in ascending order of sequence number. The sequence number can be a value contained in the TCP header data of the TCP packet. If no matching entry is found, a new reassembly entry is created in the stream reassembly list, and the TCP packet is placed into this new entry.

[0104] After a TCP packet is stored in the reassembly table, it is determined whether the data segment of that TCP packet has been completely received. If it has been completely received, the data portions of the data segments of all target TCP packets corresponding to the target reassembly entry in the stream reassembly list are concatenated to obtain the application layer message. This application layer message can be input into the Secure Shell Protocol parsing module in the electronic device. Determining whether the data segments of consecutive TCP packets in the same direction have been completely received can be based on a first preset condition and a second preset condition.

[0105] In this embodiment, storing TCP packets in the current network data packets based on a preset sorting rule yields more accurate application-layer messages. Determining whether consecutive TCP packets in the same direction are received completely based on a first and a second preset condition improves the integrity of the obtained application-layer messages. Therefore, based on the above specific steps, the integrity and accuracy of the obtained application-layer messages can be improved, further enhancing the reliability of obtaining the current data packets.

[0106] In one implementation, the interaction process of the Secure Shell protocol can be divided into the following stages: (a) version number negotiation stage; (b) key and algorithm negotiation stage; and (c) encrypted communication stage. The encrypted communication stage can be further divided into: (c1) authentication stage; (c2) session request stage; and (c3) interactive session stage.

[0107] The version number negotiation phase and the key and algorithm negotiation phase use plaintext transmission, while the encrypted communication phase uses ciphertext transmission. The Secure Shell protocol parsing module parses the protocol data according to the Secure Shell protocol specifications to determine whether the protocol interaction process has entered the authentication phase. When it is determined that the authentication phase has been entered, the authentication phase data packet is input into the login behavior recognition module, enabling the login behavior recognition module to analyze and judge the login behavior.

[0108] In one embodiment, determining that a current session is experiencing hacking behavior when the lengths of a predetermined number of consecutive target data packets in a length sequence are all the same can be achieved in the following way:

[0109] If the length of a predetermined number of consecutive target data packets in the length sequence is determined to be the target length, the predetermined number of abnormal logins is determined as the number of abnormal logins. The predetermined number of abnormal logins is the difference between the predetermined number and a first number. The first number is the number of data packets of the target length sent by the server device to the client device before login. If the length of the next data packet after the predetermined number of consecutive target data packets in the length sequence is determined to be the target length, the target number of abnormal logins is determined based on the number of abnormal logins. The target number of abnormal logins is the current total number of abnormal logins in the current session. If the target number of abnormal logins is greater than the predetermined number, it is determined that the current session has been compromised.

[0110] The preset number of attempts can be a threshold set based on the number of abnormal login attempts to determine the cracking behavior. The preset number of abnormal login attempts can be considered as the number of abnormal login attempts set to determine if an abnormal login has occurred in the session. Additionally, the target data packet corresponding to the first target length in the length sequence may not be the target data packet generated by the abnormal login behavior. During SSH connection, in order for the client device to display the login box, the server device sends a first data packet to the client device before the client device displays the login box. This triggers the display of the login box when the client device receives the first data packet, allowing the user to enter their username and password. The server device then verifies the username and password and returns the corresponding data packet to the client device.

[0111] Therefore, the first quantity has two possible values. In the first case, when the length of the first data packet is the target length, it means that the length of the first data packet returned by the server to the client before login verification is the same as the length of a consecutive preset number of target data packets in the length sequence. In this case, the first quantity is 1. Assuming the preset quantity is n, the difference between the preset quantity and the first quantity is n-1, meaning the number of abnormal logins is n-1. For example, if the preset quantity n equals 3, and the recorded length sequence is [6; 7; 7; 7], we know that three target data packets have a length of 7, and these three target data packets are consecutive. Therefore, the length of consecutive target data packets with the same length is 7, which is the target length. The number of target lengths, 3, equals the preset quantity n, so the number of abnormal logins is 2.

[0112] In the second scenario, if the length of the first data packet is not the target length, it means that the length of the first data packet returned by the server device to the client device before the login behavior verification is different from the length of the target data packets in the length sequence of a consecutive preset number. In this case, the value of the first number is 0, and the difference between the preset number and the first number is still the preset number. That is, the preset number is equivalent to the number of abnormal login attempts set to determine that there is an abnormal login in the session.

[0113] After determining the number of abnormal login attempts, the number can be updated based on the target length recorded in the length sequence. Optionally, the target number of abnormal login attempts can be determined by updating the length sequence and then updating the number based on the updated target length. For example, if the length sequence before the update is [6; 7; 7; 7], and the determined number of abnormal login attempts is 2, and then a target length of 7 is recorded in the length sequence, the updated length sequence becomes [6; 7; 7; 7; 7], and the number of abnormal login attempts is updated to 3. If the target number of abnormal login attempts exceeds a preset number, it is determined that the current session has been compromised.

[0114] In one implementation, the login behavior recognition module determines the number of abnormal login attempts. After determining the number of abnormal login attempts, the login behavior recognition module sends a notification message to the brute-force attack detection module. This notification message may include the initiator IP, server IP, destination port, and the number of abnormal login attempts. If the target number of abnormal login attempts continues to increase after subsequent length sequence updates, the login behavior recognition module can send another notification to the brute-force attack detection module.

[0115] There are at least two ways to send notification messages:

[0116] The first approach involves sending a notification message the first time an abnormal login attempt is detected. Subsequent notifications are sent for each additional abnormal login attempt. For example, the initial notification message might include n-1 abnormal login attempts. If a new target length is consecutively recorded after the previous target length in the length sequence, the abnormal login attempt count is incremented by 1, and a new notification message containing 1 abnormal login attempt is sent. This continues until no more new target lengths appear consecutively in the length sequence. Once this step is complete, the process can be terminated. This method improves the timeliness of the detection, allowing the brute-force detection module to update the abnormal login count promptly and identify brute-force attacks in a timely manner.

[0117] The second approach involves sending a notification message the first time an abnormal login attempt occurs. A second notification message is then sent only when the abnormal login attempt count stops increasing (i.e., when the target length no longer appears consecutively in the length sequence). For example, the first notification message might include n-1 abnormal login attempts, while the second notification message might include the total number of abnormal login attempts obtained by summing the previous attempts. This method saves system computing power and improves data processing efficiency.

[0118] In this embodiment, the difference between a preset number and a first number is determined as the number of abnormal login attempts. The target number of abnormal login attempts can be determined using this number. By judging the target number of abnormal login attempts based on the preset number, it can be determined whether any hacking behavior exists in the current session. Based on this, the goal of quickly and accurately detecting hacking behavior can be achieved.

[0119] In one embodiment, determining the target number of abnormal login attempts based on the number of abnormal login attempts can be achieved in the following way:

[0120] If a login entry corresponding to the current session is found in the login record table, the target number of abnormal logins is determined based on the number of abnormal logins and the number of logins corresponding to the login entry. The login entry is used to count the number of abnormal logins from the client device to the server device in the current session. If no login entry corresponding to the current session is found in the login record table, a login entry is created, the number of abnormal logins is determined as the target number of abnormal logins, and the target number of abnormal logins is stored in correspondence with the login entry.

[0121] The purpose of the login table entries is to count how many abnormal login behaviors, i.e. how many improper login behaviors, have occurred during the current session from the client device to the server device.

[0122] For example, the login record table can be a record table used to record the number of abnormal logins. When recording the number of abnormal logins, the abnormal login count is stored according to the login table entries.

[0123] For example, a login record table might be set up in the brute-force attack detection module. When the brute-force attack detection module receives a notification message from the login behavior recognition module, it parses the information in the notification message. This notification message may include the session initiator's IP, server IP, destination port, and the number of abnormal login attempts. After parsing the notification message, the brute-force attack detection module can create a login entry based on the session initiator's IP, server IP, and destination port. Subsequently, when receiving various notification messages, it stores the corresponding number of abnormal login attempts based on these login entries. The number of abnormal login attempts stored in the login entry is the login count corresponding to that entry.

[0124] If a login entry for the current session is found in the login record table (meaning the entry and its corresponding login count have been stored previously), the target abnormal login count can be determined by adding the abnormal login count parsed from the received notification message and the corresponding login count for that entry. If the target abnormal login count exceeds a preset count, the current session is suspected of being compromised. If no login entry for the current session is found in the login record table, a new entry can be created. This new entry records the abnormal login count parsed from the notification message. This new entry is then used as the target abnormal login count. If the target abnormal login count exceeds a preset count, the current session is suspected of being compromised.

[0125] In this embodiment, by using the login record table and the login entries in the login record table, the number of abnormal logins can be stored accordingly. When processing multiple cracking behavior detection tasks at the same time, the statistical disorder of the number of abnormal logins can be avoided, thereby avoiding affecting the accuracy of cracking behavior detection.

[0126] Cracking attacks typically result in a large number of login failures within a short time interval. Based on this characteristic of cracking attacks, and building upon the method provided in the previous embodiment, the accuracy of cracking attack detection can be further improved by setting a preset duration to determine the duration of abnormal login behavior.

[0127] In one embodiment, determining that the current session has been compromised when the number of abnormal login attempts exceeds a preset number can be achieved in the following way:

[0128] Obtain the creation time of the login entry; if the time interval between the current time and the creation time is less than or equal to a preset duration, and the number of abnormal login attempts is greater than or equal to a preset number, determine that the current session has been compromised.

[0129] For example, the creation time of a login entry is the time when the login entry is created in the login record table. The preset duration can be a duration set based on requirements. This preset duration is used to determine the size of the time interval between the current time and the creation time.

[0130] For example, a preset duration can be set in the brute-force detection module, such as 1 second (S). The creation time of the login entry in the login record table is obtained, along with the current time. The time interval between the current time and the creation time is calculated. The target number of abnormal logins corresponding to that login entry at the current time is obtained. If the time interval is less than or equal to the preset duration, and the target number of abnormal logins is greater than or equal to the preset number, it indicates that a large number of login failures have occurred within the shortened time interval, thus confirming that the current session contains brute-force attacks.

[0131] In one embodiment, the method further includes: determining that the current session does not involve any cracking behavior when the time interval is greater than a preset duration and / or the number of abnormal login attempts is less than a preset number.

[0132] For example, the system retrieves the creation time of the login entry in the login record table and the current time, calculating the time interval between the current time and the creation time. It then retrieves the target number of abnormal login attempts corresponding to that login entry at the current time. If the time interval is greater than a preset duration, the current session is determined to be free of hacking behavior; if the target number of abnormal login attempts is less than a preset number, the current session is determined to be free of hacking behavior; and if both the time interval and the target number of abnormal login attempts are greater than a preset duration and less than a preset number, the current session is determined to be free of hacking behavior.

[0133] In one implementation, the brute-force attack detection module has a preset duration. After receiving a notification message from the login behavior recognition module, the brute-force attack detection module stores the abnormal login counts contained in the notification message according to the corresponding login entries. It obtains the current time and the creation time of the login entry in the login record table, and calculates the time interval between the two. It then obtains the target abnormal login count corresponding to the login entry at the current time. If the time interval is greater than the preset duration, and / or the target abnormal login count is less than the preset count, then it is determined that the current session does not exhibit brute-force behavior. If the time interval is less than or equal to the preset duration, and the target abnormal login count is greater than or equal to the preset count, then it is determined that the current session exhibits brute-force behavior. If brute-force behavior is determined to exist in the current session, the brute-force attack detection module can generate an alarm message to report the detection result of the brute-force behavior.

[0134] For example, when the brute-force detection module implements the above process, it can be represented as the following steps STEP1 to STEP3:

[0135] STEP 1: Create an empty hash table (HashTable)

[0136] STEP2:

[0137] IF (session initiator IP, server IP, and destination port) in HashTable

[0138] Find the corresponding HashNode.

[0139] HashNode.num := HashNode.num + Number of abnormal login attempts

[0140] ELSE

[0141] Create a HashNode on the HashTable based on the initiator's IP, server's IP, and destination port.

[0142] HashNode.num:=Number of abnormal login attempts

[0143] HashNode.time:=Current time

[0144] FI

[0145] STEP 3:

[0146] IF HashNode.num > preset number of times

[0147] A hacking attempt has been detected, and an alarm message has been generated.

[0148] FI

[0149] Timer triggered:

[0150] If current time - HashNode.time > preset duration

[0151] Deleting the current node after confirming no hacking activity has occurred.

[0152] FI

[0153] Here, HashTable is the login record table, HashNode is the login table entry, HashNode.num is the number of abnormal logins, and HashNode.time is the creation time of the login table entry.

[0154] In this embodiment, based on the characteristic that cracking behavior usually occurs with a large number of login failures within a short time interval, the duration of abnormal login behavior is judged by setting a preset time. If more than a preset number of abnormal login behaviors occur within the preset time, it can be accurately determined that the current session has cracking behavior.

[0155] The cracking behavior detection method provided in this embodiment of the invention connects the electronic device to the mirror interface of the switch. The electronic device captures the encrypted data packets of the Secure Shell protocol through a bypass passive probing method. The abnormal login behavior of the Secure Shell protocol is identified by the length characteristics of the encrypted data packets, thereby realizing the detection of brute-force attacks against the Secure Shell protocol. Since the electronic device is an independent device, it does not occupy the resources of the Secure Shell protocol server device, nor does it require setting the above-mentioned modules included in the electronic device on the server device. Therefore, it does not affect the system stability of the server device and has strong versatility.

[0156] The following describes the cracking behavior detection device provided in the embodiments of the present invention. The cracking behavior detection device described below can be referred to in correspondence with the cracking behavior detection method described above.

[0157] Figure 3 This is a schematic diagram of the structure of the hacking behavior detection device provided in an embodiment of the present invention, as shown below. Figure 3 As shown, the hacking behavior detection device 300 includes:

[0158] The acquisition unit 310 is used to acquire target data packets from the server device in the encrypted communication stage in the current session when it is determined that the application layer protocol of the current session is the Secure Shell protocol.

[0159] The determining unit 320 is used to determine that the current session has a cracking behavior when the cumulative number of the acquired target data packets is less than a preset number and the length of each target data packet is the same.

[0160] Optionally, the acquisition unit 310 is specifically used for:

[0161] Retrieves the current data packet in the encrypted communication phase of the current session;

[0162] If the current data packet is determined to be the first data packet from the client device, the next data packet in the current session that is in the encrypted communication stage is obtained, and the next data packet is determined as the target data packet;

[0163] Unit 320 is specifically used for:

[0164] If the target data packet is determined to be a data packet from the server device, update the cumulative number of data packets from the server device that are in the encrypted communication stage;

[0165] If the updated cumulative number is less than the preset number and the length of the target data packet is less than the preset length, the length of the target data packet is recorded in the length sequence, and a new data packet in the current session that is in the encrypted communication stage is obtained and the new data packet is used as the new target data packet.

[0166] If the lengths of a predetermined number of consecutive target data packets in a length sequence are all the same, it is determined that the current session is experiencing hacking behavior.

[0167] Optionally, the acquisition unit 310 is specifically used for:

[0168] Obtain network packets from the server device in the current session through the mirror interface;

[0169] Match the application layer protocol data of network packets with the secure shell protocol identification rules;

[0170] If a match is successful, the application layer protocol of the current session is determined to be the Secure Shell protocol.

[0171] Optionally, the current data packet is a data packet in the encrypted communication stage of the current session obtained from the application layer message, and the application layer message is a message obtained by reassembling the continuous target TCP data packets in the direction of the first data packet into a TCP stream.

[0172] Optionally, unit 320 is specifically used for:

[0173] If it is determined that the length of a consecutive preset number of target data packets in the length sequence is the target length, the preset number of abnormal occurrences is determined as the number of abnormal logins; the preset number of abnormal occurrences is the difference between the preset number and a first number; the first number is the number of data packets of the target length sent by the server device to the client device before login;

[0174] If the length of the next data packet after determining the length of a predetermined number of consecutive target data packets in the length sequence is the target length, then the target abnormal login count is determined based on the abnormal login count; the target abnormal login count is the current total number of abnormal logins in the current session.

[0175] If the number of abnormal login attempts exceeds a preset number, it is determined that the current session involves hacking behavior.

[0176] Optionally, unit 320 is specifically used for:

[0177] If the login entry corresponding to the current session is found in the login record table, the target number of abnormal logins is determined based on the number of abnormal logins and the number of logins corresponding to the login entry; the login entry is used to count the number of abnormal logins from the client device to the server device in the current session;

[0178] If no login entry corresponding to the current session is found in the login record table, a login entry is created, the number of abnormal logins is determined as the target number of abnormal logins, and the target number of abnormal logins is stored in the corresponding login entry.

[0179] Optionally, unit 320 is specifically used for:

[0180] Get the creation time of the login table entries;

[0181] If the time interval between the current moment and the creation moment is less than or equal to the preset duration, and the number of abnormal login attempts is greater than or equal to the preset number, it is determined that the current session contains hacking behavior.

[0182] Optionally, the defining unit 320 is also specifically used for:

[0183] If the time interval is greater than the preset duration, and / or the number of abnormal login attempts is less than the preset number, it is determined that there is no cracking behavior in the current session.

[0184] The apparatus of this embodiment can be used to execute the method of the cracking behavior detection method side embodiment. Its specific implementation process and technical effects are similar to those of the cracking behavior detection method side embodiment. For details, please refer to the detailed description in the cracking behavior detection method side embodiment, which will not be repeated here.

[0185] Figure 4 This is a schematic diagram of the physical structure of the electronic device provided in the embodiments of the present invention, such as... Figure 4As shown, the electronic device may include a processor 410, a communications interface 420, a memory 430, and a communication bus 440, wherein the processor 410, the communications interface 420, and the memory 430 communicate with each other via the communication bus 440. The processor 410 can call logical instructions in the memory 430 to execute the cracking behavior detection method provided in the above embodiment. The method includes: if it is determined that the application layer protocol of the current session is the Secure Shell protocol, acquiring target data packets from the server device in the encrypted communication stage in the current session; if the cumulative number of acquired target data packets is less than a preset number, and the length of each target data packet is the same, determining that there is cracking behavior in the current session.

[0186] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0187] On the other hand, embodiments of the present invention also provide a non-transitory computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it implements the cracking behavior detection method provided in the above embodiments. The method includes: when it is determined that the application layer protocol of the current session is the Secure Shell protocol, acquiring target data packets from the server device in the encrypted communication stage in the current session; and when the cumulative number of acquired target data packets is less than a preset number and the length of each target data packet is the same, determining that there is cracking behavior in the current session.

[0188] In another aspect, embodiments of the present invention also provide a computer program product, the computer program product including a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, and when the program instructions are executed by a computer, the computer can execute the cracking behavior detection method provided in the above embodiments, the method including: when it is determined that the application layer protocol of the current session is the Secure Shell protocol, acquiring target data packets from the server device in the encrypted communication stage in the current session; when the cumulative number of acquired target data packets is less than a preset number, and the length of each target data packet is the same, determining that there is cracking behavior in the current session.

[0189] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0190] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0191] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting hacking behavior, characterized in that, include: If the application layer protocol of the current session is determined to be Secure Shell protocol, the target data packet from the server device in the current session that is in the encrypted communication stage is obtained; If the cumulative number of the target data packets obtained is less than a preset number, and the length of each target data packet is the same, it is determined that the current session has a cracking behavior. The step of obtaining the target data packet in the encrypted communication stage from the server device in the current session includes: Obtain the current data packet in the encrypted communication phase of the current session; If it is determined that the current data packet is the first data packet from the client device, the next data packet in the current session that is in the encrypted communication stage is obtained, and the next data packet is determined as the target data packet; The step of determining that the current session has been compromised when the cumulative number of the acquired target data packets is less than a preset number and all the target data packets have the same length includes: If it is determined that the target data packet is a data packet from the server device, update the cumulative number of data packets from the server device that are in the encrypted communication stage; If the updated cumulative number is less than the preset number and the length of the target data packet is less than the preset length, the length of the target data packet is recorded in the length sequence, and a new data packet in the current session that is in the encrypted communication stage is obtained, and the new data packet is used as the new target data packet. If it is determined that the lengths of a predetermined number of consecutive target data packets in the length sequence are all the same, it is determined that the current session is exhibiting hacking behavior. The step of determining that the current session has a hacking behavior when the length of a predetermined number of consecutive target data packets in the length sequence is all the same includes: If it is determined that the length of a consecutive preset number of target data packets in the length sequence is the target length, the preset number of abnormal occurrences is determined as the number of abnormal logins; the preset number of abnormal occurrences is the difference between the preset number and a first number; the first number is the number of data packets of the target length sent by the server device to the client device before login; If the length of the next data packet of a predetermined number of consecutive target data packets in the length sequence is determined to be the target length, the target abnormal login count is determined based on the abnormal login count; the target abnormal login count is the current total number of abnormal logins in the current session. If the number of abnormal login attempts exceeds a preset number, it is determined that the current session involves hacking behavior.

2. The method for detecting hacking behavior according to claim 1, characterized in that, The step of determining that the application layer protocol of the current session is the Secure Shell protocol includes: The network data packets from the server device in the current session are obtained through the mirror interface; The application layer protocol data of the network data packets is matched with the Secure Shell protocol identification rules; Upon successful matching, the application layer protocol of the current session is determined to be the Secure Shell protocol.

3. The method for detecting hacking behavior according to claim 1, characterized in that, The current data packet is a data packet in the encrypted communication stage of the current session obtained from the application layer message. The application layer message is a message obtained by reassembling a continuous target TCP data packet in the direction of the first data packet into a TCP stream.

4. The method for detecting hacking behavior according to claim 1, characterized in that, Determining the target number of abnormal logins based on the number of abnormal logins includes: If a login entry corresponding to the current session is found in the login record table, the target abnormal login count is determined based on the number of abnormal logins and the number of logins corresponding to the login entry; the login entry is used to count the number of abnormal logins from the client device to the server device in the current session; If no login entry corresponding to the current session is found in the login record table, the login entry is created, the number of abnormal logins is determined as the target number of abnormal logins, and the target number of abnormal logins is stored in correspondence with the login entry.

5. The method for detecting hacking behavior according to claim 4, characterized in that, The step of determining that the current session has hacking behavior when the number of abnormal login attempts exceeds a preset number includes: Obtain the creation time of the login entry; If the time interval between the current moment and the creation moment is less than or equal to a preset duration, and the number of abnormal login attempts is greater than or equal to the preset number, then the current session is determined to have a hacking behavior.

6. The method for detecting hacking behavior according to claim 5, characterized in that, The method further includes: If the time interval is greater than the preset duration, and / or the number of abnormal login attempts is less than the preset number, it is determined that the current session does not involve any hacking behavior.

7. A device for detecting hacking behavior, characterized in that, include: The acquisition unit is used to acquire target data packets from the server device in the encrypted communication stage in the current session when it is determined that the application layer protocol of the current session is the Secure Shell protocol. The determining unit is configured to determine that the current session has a cracking behavior when the cumulative number of the acquired target data packets is less than a preset number and the length of each target data packet is the same. The acquisition unit is configured to acquire target data packets from the server device in the encrypted communication phase during the current session, including: Obtain the current data packet in the encrypted communication phase of the current session; If it is determined that the current data packet is the first data packet from the client device, the next data packet in the current session that is in the encrypted communication stage is obtained, and the next data packet is determined as the target data packet; The determining unit is configured to determine that the current session has a hacking behavior when the cumulative number of the acquired target data packets is less than a preset number and the length of each target data packet is the same, including: If it is determined that the target data packet is a data packet from the server device, update the cumulative number of data packets from the server device that are in the encrypted communication stage; If the updated cumulative number is less than the preset number and the length of the target data packet is less than the preset length, the length of the target data packet is recorded in the length sequence, and a new data packet in the current session that is in the encrypted communication stage is obtained, and the new data packet is used as the new target data packet. If it is determined that the lengths of a predetermined number of consecutive target data packets in the length sequence are all the same, it is determined that the current session is exhibiting hacking behavior. The step of determining that the current session has a hacking behavior when the length of a predetermined number of consecutive target data packets in the length sequence is all the same includes: If it is determined that the length of a consecutive preset number of target data packets in the length sequence is the target length, the preset number of abnormal occurrences is determined as the number of abnormal logins; the preset number of abnormal occurrences is the difference between the preset number and a first number; the first number is the number of data packets of the target length sent by the server device to the client device before login; If the length of the next data packet of a predetermined number of consecutive target data packets in the length sequence is determined to be the target length, the target abnormal login count is determined based on the abnormal login count; the target abnormal login count is the current total number of abnormal logins in the current session. If the number of abnormal login attempts exceeds a preset number, it is determined that the current session involves hacking behavior.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the cracking behavior detection method as described in any one of claims 1-6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the cracking behavior detection method as described in any one of claims 1-6.

10. A computer program product having executable instructions stored thereon, characterized in that, When executed by the processor, this instruction causes the processor to implement the cracking behavior detection method as described in any one of claims 1-6.

Images