Abnormal IP address detection method and device

Abstract

The application discloses an abnormal IP address detection method and device. The method comprises the following steps: obtaining a first SSH log; analyzing the first SSH log to obtain a first number of SSH login attempts of each first source IP address in a plurality of first sub-time periods and a first number of first destination IP addresses of the SSH login attempts of each first source IP address in a plurality of second sub-time periods; and determining whether each first source IP address recorded in the first SSH log is an abnormal IP address with illegal cracking behavior according to the size relationship between the plurality of first numbers of each first source IP address and a first preset threshold and the size relationship between the plurality of first numbers of each first source IP address and a second preset threshold. The application solves the technical problems of low efficiency and poor accuracy of related art in analyzing abnormal IP addresses with illegal cracking behavior.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, in particular to an abnormal IP address detection method and device. BACKGROUND

[0002] With the rapid development of mobile Internet, more and more people choose to manage resources and data in cloud services, intelligent devices and computer systems through SSH (Secure Shell) protocol remote connection. Although this brings convenience to users, it is also accompanied by a series of potential threats, especially illegal personnel through illegal cracking means to steal user information or remotely control user equipment.

[0003] Illegal cracking behavior is an illegal behavior method of iterative trial and error, which splices the probability expectation to guess the correct result, so as to try to crack the password, user name, find hidden pages or crack the encryption information key. Although it needs different cracking time according to the number and complexity of the password, it is still widely used because of its low technical difficulty and difficult to be found. Therefore, there is an urgent need for a method for quickly and accurately detecting the source IP address of illegal cracking behavior. SUMMARY

[0004] The embodiments of the present application provide an abnormal IP address detection method and device to at least solve the technical problems of low efficiency and poor accuracy of related art in analyzing abnormal IP addresses with illegal cracking behavior.

[0005] According to an aspect of the embodiments of the present application, an abnormal IP address detection method is provided, comprising: obtaining a first SSH log, wherein the first SSH log is used to record process information of at least one first source IP address attempting to log in a plurality of first destination IP addresses through an SSH protocol within a first time period; analyzing the first SSH log to obtain a first number of SSH login attempts of each first source IP address within a plurality of first sub-time periods and a first number of first destination IP addresses of each first source IP address attempting to log in within a plurality of second sub-time periods, wherein the first sub-time period and the second sub-time period are both less than the first time period; determining whether each first source IP address recorded in the first SSH log is an abnormal IP address with illegal cracking behavior according to a size relationship between the first number of each first source IP address and a first preset threshold and a size relationship between the first number of each first source IP address and a second preset threshold, wherein the first preset threshold and the second preset threshold are respectively determined according to an SSH connection frequency statistical feature corresponding to a second number of SSH login attempts of a plurality of second source IP addresses recorded in a plurality of second SSH logs and an SSH connection distribution statistical feature corresponding to a second number of second destination IP addresses of each second source IP address attempting to log in.

[0006] Optionally, obtaining the first SSH log comprises: obtaining the first SSH log by checking a system log file or using a system log service.

[0007] Optionally, before determining whether the first source IP address recorded in the first SSH log is an abnormal IP address with illegal cracking behavior, the method further comprises: obtaining a plurality of second SSH logs, wherein the second SSH log is used to record process information of at least one second source IP address attempting to log in a plurality of second destination IP addresses through an SSH protocol within a second time period; for each second SSH log, analyzing the second SSH log to obtain a second number of SSH login attempts of each second source IP address within a first sub-time period and a second number of second destination IP addresses of each second source IP address attempting to log in within each second sub-time period; determining an SSH connection frequency statistical index according to the second number of SSH login attempts of the plurality of second source IP addresses within the first sub-time period recorded in each second SSH log, and determining an SSH connection distribution statistical index according to the second number of second destination IP addresses of the plurality of second source IP addresses attempting to log in within the second sub-time period recorded in each second SSH log; determining the first preset threshold based on the SSH connection frequency statistical index, and determining the second preset threshold based on the SSH connection distribution statistical index.

[0008] Optionally, the SSH connection frequency statistics include at least: average number of connections and standard deviation of connection count; the SSH connection distribution statistics include at least: average number of addresses and standard deviation of address count. Determining a first preset threshold based on the SSH connection frequency statistics includes: using the sum of the average number of connections and a preset multiple of the standard deviation of connection count as the first preset threshold; determining a second preset threshold based on the SSH connection distribution statistics includes: using the sum of the average number of addresses and a preset multiple of the standard deviation of address count as the second preset threshold.

[0009] Optionally, based on the relationship between the multiple first counts of each first source IP address and a first preset threshold, and the relationship between the multiple first quantities of each first source IP address and a second preset threshold, it is determined whether each first source IP address recorded in the first SSH log is an abnormal IP address with illegal cracking behavior. This includes: for each first source IP address recorded in the first SSH log, determining whether the first number of SSH login attempts made by the first source IP address in the first sub-time period is greater than the first preset threshold; if the first number of SSH login attempts made by the first source IP address in the second target time period is greater than the first preset threshold, further determining whether the second quantity of the first destination IP address made by the first source IP address in the second sub-time period is less than the second preset threshold; if the first quantity of the first destination IP address made by the first source IP address in the third target time period is less than the second preset threshold, determining that the first source IP address is an abnormal IP address with illegal cracking behavior.

[0010] Optionally, the method further includes: determining that the first source IP address recorded in the first SSH log is a normal IP address if the first number of SSH login attempts made by the first source IP address in the second target time period is not greater than a first preset threshold, and / or if the first number of SSH login attempts made by the first destination IP address in the third target time period is not less than a second preset threshold.

[0011] Optionally, after determining that the first source IP address is an abnormal IP address with illegal cracking behavior, the method further includes: deduplicating multiple abnormal IP addresses with illegal cracking behavior to obtain the target abnormal IP address with illegal cracking behavior in the first SSH log.

[0012] According to another aspect of the embodiments of this application, an abnormal IP address detection device is also provided, comprising: an acquisition module, configured to acquire a first SSH log, wherein the first SSH log is used to record process information of at least one first source IP address attempting to log in to multiple first destination IP addresses via the SSH protocol within a first time period; an analysis module, configured to analyze the first SSH log to obtain the first number of times each first source IP address attempts SSH login within multiple first sub-time periods and the first number of first destination IP addresses attempting SSH login within multiple second sub-time periods, wherein both the first and second sub-time periods are shorter than the first time period; and an anomaly detection module, configured to determine whether each first source IP address recorded in the first SSH log is an abnormal IP address with illegal cracking behavior based on the relationship between the multiple first times of each first source IP address and a first preset threshold and the relationship between the multiple first numbers of each first source IP address and a second preset threshold, wherein the first preset threshold and the second preset threshold are determined based on the SSH connection frequency statistical characteristics corresponding to the second number of times of SSH login attempts by multiple second source IP addresses recorded in multiple second SSH logs and the SSH connection distribution statistical characteristics corresponding to the second number of second destination IP addresses attempting SSH login within multiple second source IP addresses, respectively.

[0013] According to another aspect of the embodiments of this application, a non-volatile storage medium is also provided, the non-volatile storage medium including a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-described abnormal IP address detection method by running the computer program.

[0014] According to another aspect of the embodiments of this application, a computer program product is also provided, the computer program product including a stored computer program, wherein the computer program implements the above-described abnormal IP address detection method when executed by a processor.

[0015] In this embodiment of the application, the detection system considers the characteristics of illegal hacking behavior (more frequent SSH login attempts and fewer destination IP addresses connected), and parses and counts the acquired first SSH logs to obtain the first number of SSH login attempts made by each first source IP address in multiple first sub-time periods and the first number of first destination IP addresses made by each first source IP address in multiple second sub-time periods. Then, the multiple first counts of each first source IP address are compared with a first preset threshold, and the multiple first numbers of each first source IP address are compared with a second preset threshold to determine whether each first source IP address recorded in the first SSH log is an abnormal IP address with the risk of illegal hacking behavior. The first preset threshold and the second preset threshold are determined based on the statistical characteristics of SSH connection frequency corresponding to the second number of SSH login attempts made by multiple second source IP addresses recorded in multiple second SSH logs, and the statistical characteristics of SSH connection distribution corresponding to the second number of second destination IP addresses made by each second source IP address. This enables real-time, comprehensive, and accurate detection of illegal cracking behavior, thereby solving the technical problems of low efficiency and poor accuracy in analyzing abnormal IP addresses with illegal cracking behavior. Attached Figure Description

[0016] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0017] Figure 1 This is a hardware structure block diagram of an optional computer terminal for implementing an abnormal IP address detection method according to an embodiment of this application;

[0018] Figure 2 This is a flowchart illustrating an optional abnormal IP address detection method according to an embodiment of this application;

[0019] Figure 3 This is a schematic diagram of an optional abnormal IP address detection device according to an embodiment of this application;

[0020] Figure 4 This is a schematic diagram of the structure of an optional electronic device according to an embodiment of this application. Detailed Implementation

[0021] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0022] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0023] Furthermore, all information and data (including but not limited to user device information, user personal information, etc.) involved in this application are information and data authorized by the user or fully authorized by all parties. For example, this system has an interface with the relevant user or organization. Before obtaining relevant information, it needs to send an acquisition request to the aforementioned user or organization through the interface, and obtain the relevant information after receiving consent from the aforementioned user or organization.

[0024] To better understand the embodiments of this application, the technical terms involved in the embodiments of this application are explained below:

[0025] SSH (Secure Shell) is a network security protocol that provides secure network services in insecure network environments by using encryption and authentication mechanisms to enable secure access and file transfer.

[0026] SSH login attempt: refers to the process of attempting to connect to a remote server or computer via the SSH protocol. It typically includes the following steps: client initiates connection (the user uses SSH client software to attempt to connect to the specified server IP address and port), server responds (the SSH daemon on the server receives the connection request and prepares for authentication), authentication process (the user provides credentials to verify their identity, usually including a username and password), login attempt (if the user provides correct credentials, the server will allow the user to log in; if the user provides incorrect credentials, the server will reject the login attempt and record the failed login attempt), logging (regardless of whether the login attempt is successful or not, the SSH server usually records detailed information about the attempt in the log file, including time, source IP address, username used, destination IP address, etc.), session establishment (once the user successfully logs in, SSH establishes an encrypted session through which the user can execute remote commands or administrative tasks), and session exit (after completing the operation, the user can actively exit the SSH session, or the server may automatically disconnect the session after a period of inactivity).

[0027] Example 1

[0028] According to an embodiment of this application, a method embodiment for detecting abnormal IP addresses is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0029] The methods and embodiments provided in this application can be executed on mobile terminals, computer terminals, or similar computing devices. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing an abnormal IP address detection method is shown. Figure 1 As shown, the computer terminal 10 (or mobile device 10) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0030] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0031] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the abnormal IP address detection method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the abnormal IP address detection method of the application described above. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0032] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0033] The display can be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0034] Under the above operating environment, Figure 2 This is a flowchart illustrating an optional abnormal IP address detection method according to an embodiment of this application, as shown below. Figure 2As shown, the method includes at least steps S202-S206, wherein:

[0035] Step S202: Obtain the first SSH log.

[0036] In the technical solution provided in step S202, when a user remotely connects to the server (i.e., the first destination IP address) via the SSH protocol from the client (i.e., the first source IP address), the system often records the process information of the source IP address connecting to the destination IP address via SSH to obtain SSH logs. Therefore, in order to detect whether there are abnormal IP addresses with illegal cracking behavior within a first time period (which can be understood as the time period to be detected), the detection system can first obtain the first SSH log within that first time period.

[0037] It should be noted that the aforementioned first SSH log may contain information about a single first source IP address connecting to multiple first destination IP addresses via SSH, or it may contain information about multiple first source IP addresses connecting to multiple first destination IP addresses via SSH.

[0038] Step S204: Analyze the first SSH logs to obtain the first number of SSH login attempts made by each first source IP address in multiple first sub-time periods and the first number of first destination IP addresses made by each first source IP address in multiple second sub-time periods.

[0039] In the technical solution provided in step S204, illegal cracking behavior typically involves using illegal cracking software to make numerous login attempts on one or more login pages or interfaces intended for attack, stopping only when a successful crack is achieved. Therefore, compared to normal connection behavior, illegal cracking behavior involves multiple login attempts using different username and password combinations within a short period, resulting in a more frequent number of login attempts (especially when failed attempts are included). Simultaneously, the same source IP address will attempt to log in to different destination IP addresses multiple times within a specific time period, thus reducing the number of destination IP addresses attempting login. Based on these characteristics, the detection system of this application can analyze the first SSH log to obtain feature values ​​used to detect whether the source IP address is an abnormal IP address.

[0040] Specifically, the detection system can first parse the first SSH log to obtain the record information containing fields such as the first source IP address (Src Address), the first destination IP address (Dst Address), and the time (Time) (that is, the process information of a user connecting to the first destination IP address via SSH at a certain time through the first source IP address). Then, it groups the data according to the first source IP address and counts the first number of SSH login attempts made by the first source IP address within multiple first sub-time periods and the first number of first destination IP addresses made by the first source IP address within multiple second sub-time periods. For example, the detection system can count the first number of SSH login attempts made by each first source IP address every five minutes and the first number of first destination IP addresses made by each first source IP address per day.

[0041] Step S206: Based on the relationship between the multiple first counts of each first source IP address and the first preset threshold, and the relationship between the multiple first counts of each first source IP address and the second preset threshold, determine whether each first source IP address recorded in the first SSH log is an abnormal IP address with illegal cracking behavior.

[0042] In the technical solution provided in step S206, the detection system can determine a first preset threshold and a second preset threshold based on the statistical characteristics of the SSH connection frequency corresponding to the second number of SSH login attempts made by multiple second source IP addresses recorded in multiple second SSH logs, and the statistical characteristics of the SSH connection distribution corresponding to the second number of second destination IP addresses making SSH login attempts for each second source IP address. Then, the first number of attempts counted in step S204 is compared with the first preset threshold, and the first number of attempts is compared with the second preset threshold. By judging the relationship between the two, it can detect whether the first source IP address recorded in the first SSH log is an abnormal IP address with illegal cracking behavior.

[0043] It should be noted that, to ensure the validity of the data comparison, the time range corresponding to the second number of SSH login attempts from multiple second source IP addresses should be the same as the time range corresponding to the first number of attempts from multiple first source IP addresses. Similarly, the time range corresponding to the second number of second destination IP addresses from multiple source IP addresses should be the same as the time range corresponding to the first number of attempts from multiple first source IP addresses. Furthermore, in some cases where the data collection range is different, statistical methods (such as standardization, normalization, and covariate adjustment) can be used to adjust the data for comparative analysis to reduce the impact of range differences.

[0044] The method described in this embodiment will be further described below.

[0045] As an optional implementation, in the technical solution provided in step S202 above, the method for obtaining the first SSH log may include: viewing the system log file and using the system log service, wherein:

[0046] (1) Check the / var / log / secure file. The / var / log / secure file is the main location for SSH logs, which records detailed information about all SSH connections, including time, IP address, username, password authentication method, and whether authentication was successful. Therefore, you can check the / var / log / secure file to understand the status of SSH connections.

[0047] (2) Use a system log system to view SSH system logs. For example, Journald is a Linux system log system that can centrally manage, store, and view system logs. Therefore, you can view SSH logs through Journald.

[0048] (3) Use the system log daemon to view SSH logs. For example, rsylogd is the Linux system log daemon, which can send system logs to a remote server or redirect them to other files. At the same time, rsylogd can also be used to view SSH logs.

[0049] As an optional implementation, in the technical solution provided in step S206 above, the detection system can construct statistical features by analyzing SSH logs, perform data analysis on the statistical features, and obtain a threshold for distinguishing between illegal cracking behavior and normal connection behavior by combining SSH connection behavior patterns and abnormal cracking principles. Therefore, the detection system sets a first preset threshold and a second preset threshold in the following ways:

[0050] Step 1: Obtain the second SSH logs within multiple second time periods.

[0051] Specifically, the detection system can also obtain secondary SSH logs for multiple time periods by viewing system log files or using the system log service. For example, it can obtain secondary SSH logs for five consecutive months.

[0052] Step 2: For each second SSH log, analyze the second SSH log to obtain the second number of SSH login attempts made by each second source IP address in the first sub-time period and the second number of second destination IP addresses made by each second source IP address in each second sub-time period.

[0053] Specifically, the detection system parses multiple second SSH logs to obtain the record information contained in each log, including fields such as the second source IP address (Src Address), the second destination IP address (Dst_Address), and time (Time). This information represents the process of a user connecting to the second destination IP address via SSH at a specific time using the second source IP address. Then, the system groups the logs according to the second source IP address and counts the number of second SSH login attempts made by the second source IP address within multiple first sub-time periods (denoted as Connect-count). i This can be understood as the number of SSH connections per unit of time, and the second number of second destination IP addresses that made SSH login attempts within multiple second sub-time periods from the second source IP address (denoted as Dst IP-number). i ).

[0054] Step 3: Determine the SSH connection frequency statistics based on the second number of SSH login attempts made by multiple second source IP addresses recorded in each second SSH log within the first sub-time period, and determine the SSH connection distribution statistics based on the second number of second destination IP addresses made by multiple second source IP addresses recorded in each second SSH log within the second sub-time period.

[0055] Specifically, the third step above can be understood as analyzing the Connect-counts obtained from the second SSH logs in the second step. i Dst IP-number i Sort the data in ascending order of size, and use tools such as calculators, spreadsheet software (e.g., Microsoft Excel, Google Sheets), and statistical software (e.g., SPSS, Python's NumPy library) to calculate statistical indicators. The calculated statistical indicators must include at least the mean (the average value of the data) and the standard deviation (the square root of the variance, used to represent the degree of data dispersion). Therefore, the SSH connection frequency statistical indicators determined by the above methods must include at least the average number of connections and the standard deviation of the number of connections. The SSH connection distribution statistical indicators must include at least the average number of addresses and the standard deviation of the number of addresses.

[0056] Step 4: Determine the first preset threshold based on SSH connection frequency statistics, and determine the second preset threshold based on SSH connection distribution statistics.

[0057] Optionally, the detection system can use the sum of the average number of connections and the standard deviation of the number of connections by a preset multiple as the first preset threshold (denoted as Count). MaxThe sum of the average number of addresses and the standard deviation of the number of addresses at a preset multiple is used as the second preset threshold (denoted as Number). Max ).

[0058] For example, the first preset threshold can be set to the average number of connections plus two or three times the standard deviation of the number of connections. Similarly, the second preset threshold can be set to the average number of addresses plus two or three times the standard deviation of the number of addresses.

[0059] As an optional implementation, in the technical solution provided in step S206 above, the detection system can perform the following judgment process on the statistical information of each first source IP address recorded in the first SSH log to detect whether the first source IP address is an abnormal IP address with illegal cracking behavior, including:

[0060] The detection system can first determine whether the first number of SSH login attempts made by the first source IP address within the first sub-time period exceeds a first preset threshold, that is, determine the Connect-count. i Is it greater than Count? Max ,in,

[0061] If the first source IP address makes no more than the first preset threshold number of SSH login attempts within the second target time period, that is, the first source IP address makes fewer SSH login attempts per unit time, based on the characteristics of illegal cracking behavior (i.e., initiating multiple SSH login attempts from a single source IP address in a short period of time to quickly try all possible username and password combinations), it can be preliminarily determined that it is a normal IP address.

[0062] If the first source IP address makes more than the first preset threshold during the second target time period, meaning the first source IP address makes a large number of SSH login attempts per unit time, it indicates that the user has made multiple unauthorized login attempts at the first source IP address. To further refine the determination, the detection system can also further determine whether the second number of first destination IP addresses making SSH login attempts from the first source IP address during the second sub-time period is less than the second preset threshold, i.e., determine Dst IP-number. i Is it less than Number? Max ,in,

[0063] If the number of first destination IP addresses attempting SSH login from the first source IP address within the third target time period is not less than the second preset threshold, that is, if the number of destination IP addresses attempting SSH login from the first source IP address within the set time period is large, it can be preliminarily determined that it is a normal IP address.

[0064] If the number of first-destination IP addresses attempting SSH login within the third target time period is less than the second preset threshold, the first-source IP address is determined to be an abnormal IP address with illegal hacking behavior.

[0065] By repeatedly executing the above detection steps, the detection result (i.e., whether it is an abnormal IP address indicating illegal cracking behavior) of each first source IP address recorded in the first SSH log can be obtained. Since the first SSH log may record multiple connection process information for the same first source IP address, a result can be obtained by analyzing each connection process information. Therefore, in order to finally filter out all abnormal IP addresses in the first SSH log that contain illegal cracking behavior, the detection system can also perform deduplication on the detection result obtained in step S206 above, i.e., deduplication of multiple abnormal IP addresses containing illegal cracking behavior, to obtain the abnormal IP addresses in the first SSH log that contain illegal cracking behavior.

[0066] Based on the scheme defined in steps S202 to S206 above, it can be understood that, in the embodiment, the detection system considers the characteristics of illegal cracking behavior (more frequent SSH login attempts, fewer destination IP addresses connected), parses and counts the acquired first SSH logs to obtain the first number of SSH login attempts made by each first source IP address in multiple first sub-time periods and the first number of first destination IP addresses made by each first source IP address in multiple second sub-time periods; then, the multiple first counts of each first source IP address are compared with a first preset threshold, and the multiple first numbers of each first source IP address are compared with a second preset threshold to determine whether each first source IP address recorded in the first SSH log is an abnormal IP address with the risk of illegal cracking behavior. The first preset threshold and the second preset threshold are determined based on the statistical characteristics of SSH connection frequency corresponding to the second number of SSH login attempts made by multiple second source IP addresses recorded in multiple second SSH logs, and the statistical characteristics of SSH connection distribution corresponding to the second number of second destination IP addresses made by each second source IP address. This enables real-time, comprehensive, and accurate detection of illegal cracking behavior, thereby solving the technical problems of low efficiency and poor accuracy in analyzing abnormal IP addresses with illegal cracking behavior.

[0067] Example 2

[0068] Based on Embodiment 1 of this application, an embodiment of an abnormal IP address detection device is also provided. This device executes the abnormal IP address detection method described in the above embodiment when it operates. Figure 3This is a schematic diagram of an optional abnormal IP address detection device according to an embodiment of this application, as shown below. Figure 3 As shown, the abnormal IP address detection device includes at least an acquisition module 31, an analysis module 32, and an anomaly detection module 33, wherein:

[0069] The acquisition module 31 is used to acquire the first SSH log, wherein the first SSH log is used to record the process information of at least one first source IP address attempting to log in to multiple first destination IP addresses via the SSH protocol within a first time period;

[0070] Analysis module 32 is used to analyze the first SSH logs to obtain the first number of SSH login attempts made by each first source IP address in multiple first sub-time periods and the first number of first destination IP addresses made by each first source IP address in multiple second sub-time periods, wherein both the first and second sub-time periods are less than the first time period.

[0071] The anomaly detection module 33 is used to determine whether each first source IP address recorded in the first SSH log is an abnormal IP address with illegal cracking behavior based on the relationship between the number of first attempts of each first source IP address and the first preset threshold, and the relationship between the number of first quantities of each first source IP address and the second preset threshold. The first preset threshold and the second preset threshold are determined based on the statistical characteristics of SSH connection frequency corresponding to the second number of SSH login attempts of multiple second source IP addresses recorded in multiple second SSH logs, and the statistical characteristics of SSH connection distribution corresponding to the second quantity of second destination IP addresses of each second source IP address attempting SSH login.

[0072] It should be noted that each module in the above-mentioned abnormal IP address detection device can be a program module (for example, a set of program instructions that implement a certain function) or a hardware module. For the latter, it can be manifested in the following forms, but is not limited to them: each of the above modules is manifested as a processor, or the functions of each of the above modules are implemented by a processor.

[0073] Example 3

[0074] According to an embodiment of this application, a non-volatile storage medium is also provided, which stores a program, wherein when the program runs, it controls the device where the non-volatile storage medium is located to execute the abnormal IP address detection method in Embodiment 1.

[0075] Optionally, the device containing the non-volatile storage medium executes the following steps by running the program: acquiring a first SSH log, wherein the first SSH log is used to record process information of at least one first source IP address attempting to log in to multiple first destination IP addresses via the SSH protocol within a first time period; analyzing the first SSH log to obtain the first number of SSH login attempts made by each first source IP address within multiple first sub-time periods and the first number of first destination IP addresses made by each first source IP address within multiple second sub-time periods, wherein both the first and second sub-time periods are shorter than the first time period; determining whether each first source IP address recorded in the first SSH log is an abnormal IP address with illegal cracking behavior based on the relationship between the multiple first number of attempts made by each first source IP address and a first preset threshold and the relationship between the multiple first number of attempts made by each first source IP address and a second preset threshold, wherein the first preset threshold and the second preset threshold are determined based on the statistical characteristics of SSH connection frequency corresponding to the second number of SSH login attempts made by multiple second source IP addresses recorded in multiple second SSH logs and the statistical characteristics of SSH connection distribution corresponding to the second number of second destination IP addresses made by each second source IP address made SSH login attempts.

[0076] According to an embodiment of this application, a computer program product is also provided, which includes a stored computer program, wherein the computer program, when executed by a processor, implements the abnormal IP address detection method in Embodiment 1.

[0077] Optionally, the computer program performs the following steps: acquiring a first SSH log, wherein the first SSH log is used to record process information of at least one first source IP address attempting to log in to multiple first destination IP addresses via the SSH protocol within a first time period; analyzing the first SSH log to obtain the first number of SSH login attempts made by each first source IP address within multiple first sub-time periods and the first number of first destination IP addresses made by each first source IP address within multiple second sub-time periods, wherein both the first and second sub-time periods are shorter than the first time period; determining whether each first source IP address recorded in the first SSH log is an abnormal IP address with illegal cracking behavior based on the relationship between the multiple first number of attempts made by each first source IP address and a first preset threshold and the relationship between the multiple first number of attempts made by each first source IP address and a second preset threshold, wherein the first preset threshold and the second preset threshold are determined based on the SSH connection frequency statistical characteristics corresponding to the second number of SSH login attempts made by multiple second source IP addresses recorded in multiple second SSH logs and the SSH connection distribution statistical characteristics corresponding to the second number of second destination IP addresses made by each second source IP address made SSH login attempts.

[0078] According to an embodiment of this application, a processor is also provided for running a program, wherein the abnormal IP address detection method in embodiment 1 is executed during program execution.

[0079] Optionally, the program executes the following steps during runtime: acquiring a first SSH log, wherein the first SSH log records information about at least one first source IP address attempting to log in to multiple first destination IP addresses via the SSH protocol within a first time period; analyzing the first SSH log to obtain the first number of SSH login attempts made by each first source IP address within multiple first sub-time periods and the first number of first destination IP addresses made by each first source IP address within multiple second sub-time periods, wherein both the first and second sub-time periods are shorter than the first time period; determining whether each first source IP address recorded in the first SSH log is an abnormal IP address with illegal cracking behavior based on the relationship between the multiple first attempts of each first source IP address and a first preset threshold, and the relationship between the multiple first numbers of each first source IP address and a second preset threshold, wherein the first and second preset thresholds are determined based on the statistical characteristics of SSH connection frequency corresponding to the second number of SSH login attempts made by multiple second source IP addresses recorded in multiple second SSH logs, and the statistical characteristics of SSH connection distribution corresponding to the second number of second destination IP addresses made by each second source IP address made SSH login attempts.

[0080] According to an embodiment of this application, an electronic device is also provided, wherein, Figure 4 This is a schematic diagram of the structure of an optional electronic device according to an embodiment of this application, such as... Figure 4 As shown, the electronic device includes one or more processors; a memory for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to run the programs, wherein the programs are configured to execute the abnormal IP address detection method in Embodiment 1 above during runtime.

[0081] Optionally, the processor is configured to execute the following steps via a computer program: acquiring a first SSH log, wherein the first SSH log is used to record process information of at least one first source IP address attempting to log in to multiple first destination IP addresses via the SSH protocol within a first time period; analyzing the first SSH log to obtain the first number of SSH login attempts made by each first source IP address within multiple first sub-time periods and the first number of first destination IP addresses made by each first source IP address within multiple second sub-time periods, wherein both the first and second sub-time periods are shorter than the first time period; determining whether each first source IP address recorded in the first SSH log is an abnormal IP address with illegal cracking behavior based on the relationship between the multiple first number of attempts made by each first source IP address and a first preset threshold and the relationship between the multiple first number of attempts made by each first source IP address and a second preset threshold, wherein the first preset threshold and the second preset threshold are determined based on the SSH connection frequency statistical characteristics corresponding to the second number of SSH login attempts made by multiple second source IP addresses recorded in multiple second SSH logs and the SSH connection distribution statistical characteristics corresponding to the second number of second destination IP addresses made by each second source IP address made SSH login attempts.

[0082] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0083] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0084] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between units or modules may be electrical or other forms.

[0085] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0086] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0087] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to related technologies, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0088] The above are merely preferred embodiments of this application. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for detecting abnormal IP addresses, characterized in that, include: Obtain the first secure shell SSH log, wherein the first SSH log is used to record the process information of at least one first source IP address attempting to log in to multiple first destination IP addresses via the SSH protocol within a first time period; The first SSH logs are analyzed to obtain the first number of SSH login attempts made by each first source IP address in multiple first sub-time periods and the first number of first destination IP addresses made by each first source IP address in multiple second sub-time periods, wherein both the first sub-time periods and the second sub-time periods are shorter than the first time period. Based on the relationship between the number of first attempts of each first source IP address and the first preset threshold, and the relationship between the number of first quantities of each first source IP address and the second preset threshold, it is determined whether each first source IP address recorded in the first SSH log is an abnormal IP address with illegal cracking behavior. The first preset threshold and the second preset threshold are determined based on the statistical characteristics of SSH connection frequency corresponding to the second number of SSH login attempts of multiple second source IP addresses recorded in multiple second SSH logs, and the statistical characteristics of SSH connection distribution corresponding to the second quantity of second destination IP addresses of each second source IP address attempting SSH login. Before determining whether the first source IP address recorded in the first SSH log is an abnormal IP address with illegal hacking behavior, the method further includes: acquiring multiple second SSH logs, wherein the second SSH logs are used to record process information of at least one second source IP address attempting to log in to multiple second destination IP addresses via the SSH protocol within a second time period; for each second SSH log, analyzing the second SSH log to obtain a second number of SSH login attempts made by each second source IP address within a first sub-time period and a second number of second destination IP addresses for which each second source IP address made SSH login attempts within each second sub-time period; based on the multiple second source IP addresses recorded in each second SSH log... The SSH connection frequency metric is determined by the second number of SSH login attempts made by the source IP address within the first sub-time period, and the SSH connection distribution metric is determined by the second number of second destination IP addresses made by the multiple second source IP addresses in each second SSH log within the second sub-time period. The SSH connection frequency metric includes at least: average number of connections and standard deviation of connection counts, and the SSH connection distribution metric includes at least: average number of addresses and standard deviation of address counts. The sum of the average number of connections and the standard deviation of connection counts by a preset multiple is used as the first preset threshold, and the sum of the average number of addresses and the standard deviation of address counts by a preset multiple is used as the second preset threshold.

2. The method according to claim 1, characterized in that, Obtain the first SSH log, including: Obtain the first SSH log by viewing the system log file or using the system log service.

3. The method according to claim 1, characterized in that, Based on the relationship between the multiple first counts of each first source IP address and a first preset threshold, and the relationship between the multiple first counts of each first source IP address and a second preset threshold, determine whether each first source IP address recorded in the first SSH log is an abnormal IP address with illegal cracking behavior, including: For each first source IP address recorded in the first SSH log, determine whether the first number of SSH login attempts made by the first source IP address in the first sub-time period is greater than the first preset threshold. If the first number of SSH login attempts made by the first source IP address in the second target time period is greater than the first preset threshold, it is further determined whether the second number of first destination IP addresses made by the first source IP address in the second sub-time period is less than the second preset threshold. If the first number of first destination IP addresses attempting SSH login within the third target time period is less than the second preset threshold, the first source IP address is determined to be an abnormal IP address with illegal hacking behavior.

4. The method according to claim 3, characterized in that, The method further includes: If the first number of SSH login attempts made by the first source IP address within the second target time period is not greater than the first preset threshold, and / or if the first number of SSH login attempts made by the first source IP address within the third target time period by the first destination IP address is not less than the second preset threshold, then the first source IP address recorded in the first SSH log is determined to be a normal IP address.

5. The method according to claim 3, characterized in that, After determining that the first source IP address is an abnormal IP address with illegal hacking behavior, the method further includes: The multiple abnormal IP addresses exhibiting illegal cracking behavior are deduplicated to obtain the target abnormal IP addresses exhibiting illegal cracking behavior in the first SSH log.

6. An abnormal IP address detection device, characterized in that, include: The acquisition module is used to acquire the first SSH log, wherein the first SSH log is used to record the process information of at least one first source IP address attempting to log in to multiple first destination IP addresses via the SSH protocol within a first time period; The analysis module is used to analyze the first SSH logs to obtain the first number of SSH login attempts made by each first source IP address in multiple first sub-time periods and the first number of first destination IP addresses made by each first source IP address in multiple second sub-time periods, wherein both the first sub-time periods and the second sub-time periods are shorter than the first time period. An anomaly detection module is used to determine whether each first source IP address recorded in the first SSH log is an abnormal IP address with illegal cracking behavior based on the relationship between the number of first attempts of each first source IP address and a first preset threshold, and the relationship between the number of first quantities of each first source IP address and a second preset threshold. The first preset threshold and the second preset threshold are determined based on the statistical characteristics of SSH connection frequency corresponding to the second number of SSH login attempts of multiple second source IP addresses recorded in multiple second SSH logs, and the statistical characteristics of SSH connection distribution corresponding to the second quantity of second destination IP addresses of each second source IP address attempting SSH login. The device is further configured to: before determining whether the first source IP address recorded in the first SSH log is an abnormal IP address with illegal hacking behavior, acquire multiple second SSH logs, wherein the second SSH logs are used to record process information of at least one second source IP address attempting to log in to multiple second destination IP addresses via the SSH protocol within a second time period; for each second SSH log, analyze the second SSH log to obtain a second number of SSH login attempts made by each second source IP address within a first sub-time period and a second number of second destination IP addresses for which each second source IP address made SSH login attempts within each second sub-time period; based on the multiple second source IP addresses recorded in each second SSH log... The SSH connection frequency metric is determined by the second number of SSH login attempts made by the source IP address within the first sub-time period, and the SSH connection distribution metric is determined by the second number of second destination IP addresses made by the multiple second source IP addresses in each second SSH log within the second sub-time period. The SSH connection frequency metric includes at least: average number of connections and standard deviation of connection counts, and the SSH connection distribution metric includes at least: average number of addresses and standard deviation of address counts. The sum of the average number of connections and the standard deviation of connection counts by a preset multiple is used as the first preset threshold, and the sum of the average number of addresses and the standard deviation of address counts by a preset multiple is used as the second preset threshold.

7. A non-volatile storage medium, characterized in that, The non-volatile storage medium stores a computer program, wherein the device containing the non-volatile storage medium executes the abnormal IP address detection method according to any one of claims 1 to 5 by running the computer program.

8. A computer program product, characterized in that, include: A computer program, wherein when executed by a processor, the computer program implements the abnormal IP address detection method according to any one of claims 1 to 5.

Images