Remote login password cracking behavior monitoring method and device, electronic equipment and storage medium

Abstract

The application provides a remote login brute force behavior monitoring method and device, electronic equipment and a storage medium, and relates to the technical field of security protection, and the method comprises the following steps: obtaining target information corresponding to remote login through an ETW mechanism of an operating system deployed on the electronic equipment, wherein the target information comprises at least two of the following: login behavior information, RDP connection information and network connection behavior information; and monitoring whether remote login brute force behavior exists based on at least two target information in the login behavior information, the RDP connection information and the network connection behavior information. The application can obtain at least two target information in the login behavior information, the RDP connection information and the network connection behavior information based on the ETW mechanism, and jointly monitor whether remote login brute force behavior exists, thereby improving the accuracy of remote login brute force behavior monitoring.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of security protection, and particularly relates to a remote login brute force behavior monitoring method and device, electronic equipment and a storage medium. BACKGROUND

[0002] Remote brute force attack is a basic means of network attack, and is widely used due to its simplicity and directness. With the rapid development of Internet technology, the prevalence of remote office provides a large number of attack targets for brute force attacks, so it is imperative to identify remote login brute force behavior.

[0003] In related technologies, a single login event is usually monitored, login behavior information is obtained from the monitored login event, and whether there is a remote login brute force behavior is determined based on the obtained login behavior information.

[0004] However, in the above related technology, monitoring a single login event may result in incomplete login behavior information obtained from the login event, thereby reducing the accuracy of remote login brute force behavior monitoring. SUMMARY

[0005] The present application provides a remote login brute force behavior monitoring method, device, electronic equipment and storage medium to solve the problem of reducing the accuracy of remote login brute force behavior monitoring in the prior art.

[0006] The present application provides a remote login brute force behavior monitoring method applied to an electronic device, the method comprising:

[0007] Obtaining target information corresponding to remote login through an ETW mechanism of an operating system deployed on the electronic device, the target information including at least two of the following: login behavior information, RDP connection information and network connection behavior information;

[0008] Monitoring whether there is a remote login brute force behavior based on at least two target information of the login behavior information, the RDP connection information and the network connection behavior information.

[0009] According to the remote login brute force behavior monitoring method provided by the present application, the target information includes the login behavior information and the RDP connection information.

[0010] The monitoring whether there is a remote login brute force behavior based on at least two target information of the login behavior information, the RDP connection information and the network connection behavior information comprises:

[0011] Determining a login failure parameter value based on the login behavior information;

[0012] In a case where the login failure parameter value is greater than a preset failure parameter value and the network address corresponding to the remote login is not included in the login behavior information, the network address is obtained from the RDP connection information;

[0013] The remote login brute force behavior is monitored based on the network address corresponding to the remote login and the login failure parameter value.

[0014] According to the remote login brute force behavior monitoring method provided by the application, the login failure parameter value includes a login failure number and a login failure frequency, and the preset failure parameter value includes a preset login failure number and a preset login failure frequency; the login failure parameter value being greater than the preset failure parameter value includes the login failure number being greater than the preset login failure number and / or the login failure frequency being greater than the preset login failure frequency.

[0015] The login failure parameter value is determined based on the login behavior information, including:

[0016] Login state information in the login behavior information is obtained.

[0017] In a case where the login state information is login failure, the historical login failure number is added by one to obtain the login failure number, the login timestamp corresponding to the remote login is recorded, and the login failure frequency is determined based on the login timestamp corresponding to the remote login and the login timestamp corresponding to each historical login failure, the historical login failure and the remote login being logins to the same network address.

[0018] According to the remote login brute force behavior monitoring method provided by the application, the remote login brute force behavior is monitored based on the network address and the login failure parameter value, including:

[0019] A login authentication request is sent to a threat behavior identification engine, the login authentication request including the network address and the login failure frequency.

[0020] The network address and historical legal network addresses are compared by the threat behavior identification engine to obtain a first comparison result, and the login failure frequency and a historical legal login frequency are compared to obtain a second comparison result.

[0021] In a case where the first comparison result indicates that the network address and the historical legal network addresses are different, and the second comparison result indicates that the login failure frequency is greater than the historical legal login frequency, it is determined that the remote login brute force behavior exists.

[0022] According to the remote login brute force behavior monitoring method provided by the application, the login behavior information comprises login account information; and the login authentication request further comprises the login account information;

[0023] In the case that the first comparison result indicates that the network address is different from the historical legal network address, and the second comparison result indicates that the login failure frequency is greater than the historical legal login frequency, the remote login brute force behavior is determined.

[0024] The login account information and the historical legal account information are compared by the threat behavior identification engine to obtain a third comparison result.

[0025] In the case that the first comparison result indicates that the network address is different from the historical legal network address, the second comparison result indicates that the login failure frequency is greater than the historical legal login frequency, and the third comparison result indicates that the login account information does not match the historical legal account information, the remote login brute force behavior is determined.

[0026] According to the remote login brute force behavior monitoring method provided by the application, the target information further comprises the network connection behavior information; and the method further comprises:

[0027] In the case that the login failure parameter value is greater than a preset failure parameter value, and the network address is not obtained from the login behavior information and the RDP connection information, the network address corresponding to a preset port is obtained from the network connection behavior information, and the network address corresponding to the preset port is determined as the network address corresponding to the remote login, wherein the preset port is a port used for representing remote login.

[0028] According to the remote login brute force behavior monitoring method provided by the application, the target information comprises the login behavior information and the network connection behavior information; and the remote login brute force behavior is monitored based on at least two target information from the login behavior information, the RDP connection information and the network connection behavior information, comprising:

[0029] The login failure parameter value is determined based on the login behavior information.

[0030] In the case that the login failure parameter value is greater than a preset failure parameter value, the network address corresponding to the remote login is not included in the login behavior information, and the RDP connection information corresponding to the remote login is not obtained by the ETW mechanism, the network address corresponding to a preset port is obtained from the network connection behavior information, and the network address corresponding to the preset port is determined as the network address corresponding to the remote login, wherein the preset port is a port used for representing remote login.

[0031] monitoring whether remote login brute force behavior exists based on the network address corresponding to the remote login and the login failure parameter value.

[0032] According to the remote login brute force behavior monitoring method provided by the application, the method further comprises:

[0033] In the case of determining that the remote login brute force behavior exists, a target duration is determined, the target duration being a duration for preventing communication between the device corresponding to the network address and the electronic device.

[0034] The correspondence between the network address and the target duration is stored in an exception list.

[0035] The application further provides a remote login brute force behavior monitoring device, comprising:

[0036] The first acquisition unit is configured to acquire target information corresponding to remote login through an ETW mechanism of an operating system deployed on the electronic device, the target information comprising at least two of the following: login behavior information, RDP connection information and network connection behavior information.

[0037] The monitoring unit is configured to monitor whether remote login brute force behavior exists based on at least two of the target information, i.e., the login behavior information, the RDP connection information and the network connection behavior information.

[0038] The application further provides an electronic device, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the remote login brute force behavior monitoring method as described above when executing the program.

[0039] The application further provides a non-transitory computer readable storage medium having a computer program stored thereon, wherein the computer program is executable by a processor to implement the remote login brute force behavior monitoring method as described above.

[0040] The application further provides a computer program product comprising a computer program, wherein the computer program is executable by a processor to implement the remote login brute force behavior monitoring method as described above.

[0041] The application provides a remote login brute force behavior monitoring method and device, electronic equipment and a storage medium. BRIEF DESCRIPTION OF DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the application or prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative effort on the basis of these drawings.

[0043] Figure 1 Fig. 1 is one of the flow diagrams of the remote login brute force behavior monitoring method provided by the embodiments of the application.

[0044] Figure 2 Fig. 2 is another of the flow diagrams of the remote login brute force behavior monitoring method provided by the embodiments of the application.

[0045] Figure 3 Fig. 3 is a third of the flow diagrams of the remote login brute force behavior monitoring method provided by the embodiments of the application.

[0046] Figure 4 Fig. 4 is a fourth of the flow diagrams of the remote login brute force behavior monitoring method provided by the embodiments of the application.

[0047] Figure 5 Fig. 5 is a fifth of the flow diagrams of the remote login brute force behavior monitoring method provided by the embodiments of the application.

[0048] Figure 6 Fig. 6 is a sixth of the flow diagrams of the remote login brute force behavior monitoring method provided by the embodiments of the application.

[0049] Figure 7 Fig. 7 is a structural diagram of the remote login brute force behavior monitoring device provided by the embodiments of the application.

[0050] Figure 8 Fig. 8 is a structural diagram of the electronic equipment provided by the embodiments of the application. DETAILED DESCRIPTION

[0051] In order to make the objects, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described clearly and completely below in conjunction with the drawings in the present application. Obviously, the described embodiments are part of the embodiments of the present application and not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0052] Brute force is the abbreviation of password cracking, which refers to the behavior of finding the correct login credentials by trying a large number of account names and passwords for multiple times. In the related art, whether remote login brute force behavior exists is usually determined by monitoring a single login event, or monitoring network traffic, or obtaining login events through Windows GINA / CP. However, monitoring a single login event may have the problem that the login behavior information obtained from the login event is not comprehensive, monitoring network traffic may cause the problem of increased calculation, and obtaining login events through Windows GINA / CP may easily conflict with other login verification modules (such as fingerprint modules, face recognition modules, Use-Key, etc.), causing the problem of being unable to log in to the system.

[0053] Therefore, the present application provides a remote login brute force behavior monitoring method based on at least two target information of login behavior information, RDP connection information and network connection behavior information obtained based on the ETW mechanism, to jointly monitor whether remote login brute force behavior exists, so as to improve the accuracy of remote login brute force behavior monitoring.

[0054] The present application will be described below in conjunction with Figures 1-6 The remote login brute force behavior monitoring method of the present application is described. The execution subject of the remote login brute force behavior monitoring method can be a security monitoring device or an electronic device such as a terminal installed with a security monitoring module.

[0055] Figure 1 is one of the flowcharts of the remote login brute force behavior monitoring method provided by the embodiments of the present application, as shown in Figure 1 The method comprises the following steps 101 to 105.

[0056] Step 101: Obtain target information corresponding to remote login through the ETW mechanism of the operating system deployed on the electronic device, wherein the target information comprises at least two of the following: login behavior information, RDP connection information and network connection behavior information.

[0057] The operating system can be a Windows operating system, and an Event Tracing for Windows (ETW) mechanism of Windows is a tracking recording mechanism of event objects created by user layer application programs and kernel layer drivers.

[0058] For example, the user can pre-subscribe to the type of information to be collected, and obtain information corresponding to the subscribed information type based on the ETW mechanism of the Windows operating system itself. The pre-subscribed information type can include at least two of the security audit information type Microsoft-Windows-Security-Auditing, the RDP connection information type Microsoft-Windows-RemoteDesktopServices-RdpCoreTS, and the network connection information type Microsoft-Windows-Kernel-Network. The electronic device can monitor the information corresponding to the pre-subscribed information type of the user through the ETW mechanism.

[0059] In step 102, whether remote login brute force behavior exists is monitored based on at least two target information of the login behavior information, the RDP connection information, and the network connection behavior information.

[0060] For example, when at least two target information of the login behavior information, the RDP connection information, and the network connection behavior information are obtained, the content included in the at least two target information is analyzed to determine whether remote login brute force behavior exists.

[0061] The remote login brute force behavior monitoring method provided by the application obtains target information corresponding to remote login through the ETW mechanism of the operating system deployed on the electronic device, and the target information includes at least two of the login behavior information, the RDP connection information, and the network connection behavior information. Whether remote login brute force behavior exists is monitored based on at least two target information of the login behavior information, the RDP connection information, and the network connection behavior information. It can be known that the application can obtain at least two target information of the login behavior information, the RDP connection information, and the network connection behavior information based on the ETW mechanism, and jointly monitor whether remote login brute force behavior exists, thereby improving the accuracy of remote login brute force behavior monitoring. In addition, the application can ensure the stability of the obtained data through the ETW mechanism, and can obtain accurate login information related to remote login, such as login behavior information, RDP connection information, and network connection behavior information, without analyzing a large amount of network traffic, thereby reducing the amount of calculation. Moreover, the ETW mechanism and other login verification modules will not conflict, and will not cause the problem of being unable to log in to the system.

[0062] In an embodiment, the target information includes the login behavior information and the RDP connection information. Figure 2 is a flowchart of a remote login brute force behavior monitoring method provided by an embodiment of the present application, as shown in Figure 2 Step 102 monitors whether there is a remote login brute force behavior based on at least two target information among the login behavior information, the RDP connection information and the network connection behavior information, which can be implemented through the following steps.

[0063] Step 1021 determines a login failure parameter value based on the login behavior information.

[0064] The login failure parameter value includes a login failure number and a login failure frequency.

[0065] Optionally, login state information in the login behavior information is obtained; in the case that the login state information is login failure, the historical login failure number is added by one to obtain the login failure number, the login timestamp corresponding to the remote login is recorded, and the login failure frequency is determined based on the stored login timestamp corresponding to each historical login failure and the login timestamp corresponding to the remote login, the historical login and the remote login being logins to the same network address.

[0066] For example, a plurality of security audit information is monitored through an ETW mechanism, the plurality of security audit information is integrated and de-duplicated, and the login behavior information corresponding to the remote login is filtered from the plurality of security audit information, the login behavior information including login account information, login timestamp, login state information (login success or login failure), login mode (remote login or local login), protocol type used for login, and the like. Some login behavior information further includes the network address corresponding to the remote login, such as Internet Protocol (IP) address and port number and the like. When the login behavior information corresponding to the remote login is obtained, the login behavior information is parsed to obtain the login state information, in the case that the login state information is login failure, the historical login failure number is added by one to obtain the login failure number, and the login timestamp corresponding to the remote login is recorded. The login timestamp corresponding to each historical login failure recorded previously and the login timestamp corresponding to the remote login recorded this time are accumulated to determine the time interval between the earliest login timestamp in the login timestamp corresponding to the historical login failure and the login timestamp corresponding to the remote login recorded this time, and the login failure number in the time interval is determined as the login failure frequency.

[0067] Step 1022, in the case that the login failure parameter value is greater than the preset failure parameter value and the network address corresponding to the remote login is not included in the login behavior information, the network address is obtained from the RDP connection information.

[0068] The Remote Desktop Protocol (RDP) is a proprietary protocol developed by Microsoft Corporation, which provides a graphical interface for users to remotely control another electronic device through network connection. The preset failure parameter value includes a preset login failure number and a preset login failure frequency. In the initial stage of monitoring, the threat behavior identification engine can pull the thresholds for judging brute force behavior, i.e., the preset login failure number and the preset login failure frequency. The preset login failure number and the preset login failure frequency can be determined according to a plurality of historical login behaviors of a plurality of devices.

[0069] The login failure parameter value being greater than the preset failure parameter value specifically refers to the login failure number being greater than the preset login failure number, and / or the login failure frequency being greater than the preset login failure frequency.

[0070] For example, if the pre-subscribed information type includes the RDP connection information type Microsoft-Windows-RemoteDesktopServices-RdpCoreTS, the RDP connection information can be monitored through the ETW mechanism. In the case that the accumulated login failure number is greater than the preset login failure number and / or the login failure frequency is greater than the preset login failure frequency, it indicates that the login behavior is suspicious. Since multiple login behaviors are directed to the same network address, it can be determined whether the network address corresponding to the remote login, i.e., the IP address and the port number corresponding to the remote login, is included in the login behavior information. If the network address corresponding to the remote login is not included in the login behavior information, it is determined whether the RDP connection information corresponding to the remote login is obtained. If the RDP connection information corresponding to the remote login is obtained, it indicates that the user has performed remote login using the built-in RDP of the Windows operating system. If the RDP connection information corresponding to the remote login is not obtained, it indicates that the user has not performed remote login using the built-in RDP of the Windows operating system. In the case that the RDP connection information corresponding to the remote login is obtained, the obtained RDP connection information is parsed to obtain the network address corresponding to the remote login included in the RDP connection information.

[0071] Step 1023, based on the network address corresponding to the remote login and the login failure parameter value, it is monitored whether there is a remote login brute force behavior.

[0072] For example, when the network address corresponding to the remote login and the login failure parameter value are acquired, the network address corresponding to the remote login and the login failure parameter value are analyzed to determine whether the remote login brute force behavior exists.

[0073] In the embodiment, the login failure parameter value is determined based on the login behavior information corresponding to the remote login acquired through the ETW mechanism, and in the case that the login failure parameter value is greater than the preset failure parameter value and the network address corresponding to the remote login is not included in the login behavior information, the network address is acquired from the RDP connection information, and whether the remote login brute force behavior exists is monitored based on the network address and the login failure parameter value. It can be known that, when the network address corresponding to the remote login is not included in the login behavior information, the network address corresponding to the remote login is acquired from the RDP connection information, and whether the remote login brute force behavior exists is monitored based on the network address and the login failure parameter value, thereby improving the accuracy of the remote login brute force behavior monitoring.

[0074] In an embodiment, Figure 3 is a third flowchart of the remote login brute force behavior monitoring method provided by the embodiment of the present application, as shown in Figure 3 The step 1023 of monitoring whether the remote login brute force behavior exists based on the network address corresponding to the remote login and the login failure parameter value can be implemented through the following steps:

[0075] The step 301 of sending a login authentication request to the threat behavior identification engine, wherein the login authentication request includes the network address and the login failure frequency.

[0076] For example, when the number of login failures is greater than the preset number of login failures and / or the login failure frequency is greater than the preset login failure frequency, it is determined that the suspicious login behavior exists. In order to determine whether the suspicious login behavior is the remote login brute force behavior, the login authentication request including the network address and the login failure frequency is sent to the threat behavior identification engine.

[0077] The step 302 of comparing the network address with historical legal network addresses through the threat behavior identification engine to obtain a first comparison result, and comparing the login failure frequency with a historical legal login frequency to obtain a second comparison result.

[0078] The historical legal network address and the historical legal login frequency are obtained by learning the login habits of the electronic device. The historical legal network address is the network address used by the electronic device when performing normal remote login, and the historical legal login frequency is the login frequency when the electronic device performs normal remote login.

[0079] For example, the threat behavior identification engine, upon receiving the login authentication request, parses the login authentication request to obtain the login failure frequency and the network address corresponding to the remote login, and compares the network address with the historical legal network address of the electronic device. When the network address is different from the historical legal network address of the electronic device, it indicates that the network address corresponding to the remote login is suspicious, and the first comparison result is that the network address is different from the historical legal network address of the electronic device. When the network address is the same as the historical legal network address of the electronic device, it indicates that the network address corresponding to the remote login is legal, and the first comparison result is that the network address is the same as the historical legal network address of the electronic device. The login failure frequency is compared with the historical legal login frequency of the electronic device. When the login failure frequency is greater than the historical legal login frequency of the electronic device, it is determined that the login behavior is suspicious, and the second comparison result is that the login failure frequency is greater than the historical legal login frequency of the electronic device. When the login failure frequency is less than or equal to the historical legal login frequency of the electronic device, it is determined that the login behavior is legal, and the second comparison result is that the login failure frequency is less than or equal to the historical legal login frequency of the electronic device.

[0080] In step 303, when the first comparison result indicates that the network address is different from the historical legal network address, and the second comparison result indicates that the login failure frequency is greater than the historical legal login frequency, it is determined that there is a remote login brute force behavior.

[0081] For example, when the first comparison result indicates that the network address corresponding to the remote login is different from the historical legal network address of the electronic device, and the second comparison result indicates that the login failure frequency is greater than the historical legal login frequency of the electronic device, it is determined that there is a remote login brute force behavior. When the first comparison result indicates that the network address corresponding to the remote login is the same as the historical legal network address of the electronic device, and the second comparison result indicates that the login failure frequency is less than or equal to the historical legal login frequency of the electronic device, it is determined that there is no remote login brute force behavior.

[0082] In this embodiment, when the number of login failures is greater than the preset number of login failures, and / or the login failure frequency is greater than the preset login failure frequency, the login authentication request is sent to the threat behavior identification engine, and whether there is a remote login brute force behavior is further determined based on the first comparison result and the second comparison result by the threat behavior identification engine, thereby improving the accuracy of the remote login brute force behavior.

[0083] In an embodiment, the login behavior information comprises login account information; the login authentication request further comprises the login account information; and step 303 determines that remote login brute force behavior exists when the first comparison result indicates that the network address is different from the historical legitimate network address and the second comparison result indicates that the login failure frequency is greater than the historical legitimate login frequency, which can be achieved in the following manner:

[0084] The login account information is compared with historical legitimate account information by the threat behavior identification engine to obtain a third comparison result; and remote login brute force behavior is determined to exist when the first comparison result indicates that the network address is different from the historical legitimate network address, the second comparison result indicates that the login failure frequency is greater than the historical legitimate login frequency, and the third comparison result indicates that the login account information does not match the historical legitimate account information.

[0085] The historical legitimate account information is obtained by learning the login habits of the electronic device, and the historical legitimate account information is account information used by the electronic device when performing normal remote login.

[0086] For example, the login account information can also be obtained in the login behavior information, and the login account information is sent to the threat behavior identification engine in the login authentication request; when the login account information is parsed, the threat behavior identification engine further compares the login account information with the historical legitimate account information of the electronic device; when the login account information is the same as the historical legitimate account information of the electronic device, the login account information is determined to be legitimate; when the login account information is different from the historical legitimate account information of the electronic device, the login account information is determined to be suspicious; a third comparison result is obtained; remote login brute force behavior is determined to exist when the first comparison result indicates that the network address is different from the historical legitimate network address, the second comparison result indicates that the login failure frequency is greater than the historical legitimate login frequency, and the third comparison result indicates that the login account information does not match the historical legitimate account information; otherwise, remote login brute force behavior is determined to not exist.

[0087] It should be noted that the login authentication request further comprises the number of login failures; the threat behavior identification engine can update the preset number of login failures based on the number of login failures reported by the electronic device within a preset time period, so that the updated preset number of login failures is more matched with the login behavior of the electronic device; the threat behavior identification engine can update the preset login failure frequency based on the login failure frequency reported by the electronic device within a preset time period, so that the updated preset login failure frequency is more matched with the login behavior of the electronic device; and the historical legitimate account information corresponding to the electronic device can also be updated based on the login account information reported within the preset time period, which is not limited by the present application.

[0088] In the embodiment, when the number of login failures is greater than the preset number of login failures and / or the frequency of login failures is greater than the preset frequency of login failures, the login authentication request is sent to the threat behavior identification engine, and whether the remote login brute force behavior exists is further determined based on the first comparison result, the second comparison result and the third comparison result by the threat behavior identification engine, so that the accuracy of the remote login brute force behavior is further improved.

[0089] In an embodiment, the target information further includes the network connection behavior information. Figure 4 Fig. 4 is a flowchart of a remote login brute force behavior monitoring method according to an embodiment of the present application, as shown in the figure, the remote login brute force behavior monitoring method further includes the following steps: Figure 4

[0090] In step 1024, when the login failure parameter value is greater than the preset failure parameter value, and the network address corresponding to the remote login is not included in the login behavior information and the RDP connection information, the network address corresponding to the preset port is obtained from the network connection behavior information, and the network address corresponding to the preset port is determined as the network address corresponding to the remote login, the preset port being a port used to represent remote login.

[0091] For example, the pre-subscribed information type further includes the network connection information type Microsoft-Windows-Kernel-Network, the network connection behavior information can be monitored through the ETW mechanism, when the RDP connection information corresponding to the remote login is obtained, but the network address is not obtained from the RDP connection information, the network address corresponding to the preset port representing remote login is filtered from the network connection behavior information, the network address corresponding to the preset port representing remote login is determined as the network address of remote login, and the obtained network address corresponding to the remote login and the login failure parameter value are sent to the threat behavior identification engine, and whether the remote login brute force behavior exists is determined based on the network address corresponding to the remote login and the login failure parameter value by the threat behavior identification engine.

[0092] In the embodiment, when the network address is not obtained from the RDP connection information, the network connection behavior information corresponding to the remote login is obtained, and the network address corresponding to the remote login is obtained from the network connection behavior information, so that the network address corresponding to the remote login can be obtained, the login behavior information is supplemented, and the reliability of the remote login brute force behavior monitoring is improved.

[0093] In an embodiment, the target information includes the login behavior information and the network connection behavior information. Figure 5 Fig. 5 is a flowchart of a remote login brute force behavior monitoring method according to an embodiment of the present application, as shown in the figure, the remote login brute force behavior monitoring method further includes the following steps: Figure 5 ​As shown, the step 102 monitors whether remote login brute force behavior exists based on at least two target information among the login behavior information, the RDP connection information and the network connection behavior information, and the implementation can be achieved through the following steps:

[0094] The step 1025 determines a login failure parameter value based on the login behavior information.

[0095] For example, the implementation process of the step 1025 can refer to the specific description of the step 1021, and the present application will not be repeated here.

[0096] The step 1026 acquires a network address corresponding to a preset port in the network connection behavior information and determines the network address corresponding to the preset port as the network address corresponding to the remote login in the case that the login failure parameter value is greater than a preset failure parameter value, the network address corresponding to the remote login is not included in the login behavior information, and the RDP connection information corresponding to the remote login is not acquired through the ETW mechanism, and the preset port is a port used to represent remote login.

[0097] For example, in the case that the login failure parameter value is greater than the preset failure parameter value, the network address corresponding to the remote login is not included in the login behavior information, and the RDP connection information corresponding to the remote login is not acquired through the ETW mechanism, it is indicated that the user does not use the RDP built in the Windows operating system to perform remote login, and at this time, the network address corresponding to the preset port representing remote login can be filtered from the network connection behavior information, and the network address corresponding to the preset port representing remote login is determined as the network address of the remote login.

[0098] The step 1027 monitors whether remote login brute force behavior exists based on the network address corresponding to the remote login and the login failure parameter value.

[0099] For example, the implementation process of the step 1027 can refer to the specific description of the step 1023, and the present application will not be repeated here.

[0100] In the embodiment, when the RDP connection information corresponding to the remote login is not acquired through the ETW mechanism, the network connection behavior information corresponding to the remote login is acquired, and the network address corresponding to the remote login is acquired from the network connection behavior information, so that the network address corresponding to the remote login can be acquired, the login behavior information is supplemented, and the reliability of the remote login brute force behavior monitoring is improved.

[0101] In an embodiment, Figure 6 is a sixth flowchart of the remote login brute force behavior monitoring method provided by the embodiment of the present application, as shown in Figure 6As shown, after the step 102, the remote login brute force behavior monitoring method further comprises the following steps:

[0102] In step 103, when it is determined that the remote login brute force behavior exists, a target duration is determined, the target duration being a duration for preventing the device corresponding to the network address from communicating with the electronic device.

[0103] For example, when it is determined that the remote login brute force behavior exists, the network address can be sent to a disposal module, the disposal module determining a number of times that the network address has been stored in the exception list before, when the number of times is less than or equal to a first preset number of times (for example, the first preset number of times is 1), determining that the target duration is a first preset duration (for example, half an hour), when the number of times is greater than the first preset number of times and less than a second preset number of times (for example, the second preset number of times is 3), determining that the target duration is a second preset duration (for example, two hours), and when the number of times is greater than the second preset number of times, determining that the target duration is a third preset duration (for example, the entire life cycle of the security monitoring module until the security monitoring module exits), wherein the third preset duration is greater than the second preset duration, and the second preset duration is greater than the first preset duration.

[0104] In step 104, a correspondence between the network address and the target duration is stored in the exception list.

[0105] For example, when the target duration is determined, the disposal module stores the correspondence between the network address and the target duration in the exception list by using a Windows filtering platform (WFP) provided by a Windows operating system, and controls the device corresponding to the network address to be prohibited from communicating with the electronic device within the target duration. The WFP is a basic framework for interacting with data packets in five layers of a TCP / IP protocol stack provided by the Windows operating system, and the basic framework provides a series of application programming interfaces (APIs) for achieving the interaction purpose.

[0106] It should be noted that when it is determined that the remote login brute force behavior exists, the target duration can not be determined, and the disposal module directly stores the network address in the exception list permanently by using a WFP application layer interface provided by the Windows operating system, and prevents the device corresponding to the network address from communicating with the electronic device, and the present application does not limit this.

[0107] In the embodiment, when it is determined that the remote login brute force behavior exists, a target duration is determined, a correspondence between the network address and the target duration is stored in an exception list, and the device corresponding to the network address is controlled to be prohibited from communicating with the electronic device within the target duration, so that the device corresponding to the network address is prevented from being attacked, the security of the device is improved, and the defense capability is greatly improved.

[0108] It should be noted that the target information can also only include the login behavior information. The login failure parameter value is determined based on the login behavior information. In a case where the login failure parameter value is greater than a preset failure parameter value and the login behavior information includes the network address corresponding to the remote login, the network address corresponding to the remote login is obtained from the login behavior information, and the obtained network address corresponding to the remote login and the login failure parameter value are sent to the threat behavior identification engine. Whether the remote login brute force behavior exists is determined by the threat behavior identification engine based on the network address corresponding to the remote login and the login failure parameter value. That is, when the login behavior information includes the network address corresponding to the remote login, the network address corresponding to the remote login does not need to be obtained from the RDP connection information or the network connection behavior information, but is directly obtained from the login behavior information, which reduces the complexity of data processing and improves the efficiency of remote login brute force behavior monitoring. The present application does not limit this.

[0109] The remote login brute force behavior monitoring device provided by the present application will be described below. The remote login brute force behavior monitoring device described below can be correspondingly referred to the remote login brute force behavior monitoring method described above.

[0110] Figure 7 is a structural schematic diagram of the remote login brute force behavior monitoring device provided by the embodiment of the present application, as Figure 7 shown, the remote login brute force behavior monitoring device 700 includes a first acquisition unit 701 and a monitoring unit 702; wherein:

[0111] The first acquisition unit 701 is configured to acquire target information corresponding to remote login through an ETW mechanism of an operating system deployed on the electronic device, and the target information includes at least two of the following: login behavior information, RDP connection information and network connection behavior information.

[0112] The monitoring unit 702 is configured to monitor whether a remote login brute force behavior exists based on at least two of the target information in the login behavior information, the RDP connection information and the network connection behavior information.

[0113] The remote login brute force behavior monitoring device provided by the application determines a login failure parameter value based on login behavior information corresponding to the remote login obtained through the ETW mechanism, determines whether RDP connection information corresponding to the remote login is obtained through the ETW mechanism in the case that the login failure parameter value is greater than a preset failure parameter value and the network address corresponding to the remote login is not included in the login behavior information, obtains the network address from the RDP connection information when the RDP connection information corresponding to the remote login is obtained, and jointly monitors whether remote login brute force behavior exists based on the network address and the login failure parameter value. It can be known that the login behavior information is obtained through the ETW mechanism first, the network address corresponding to the remote login is obtained from the RDP connection information through the ETW mechanism when the network address corresponding to the remote login is not included in the login behavior information, and whether remote login brute force behavior exists is jointly monitored based on the network address and the login failure parameter value, thereby improving the accuracy of remote login brute force behavior monitoring.

[0114] Based on any one of the above embodiments, the target information includes the login behavior information and the RDP connection information; and the monitoring unit 702 is specifically configured to:

[0115] determine a login failure parameter value based on the login behavior information;

[0116] in the case that the login failure parameter value is greater than a preset failure parameter value and the network address corresponding to the remote login is not included in the login behavior information, obtain the network address from the RDP connection information;

[0117] monitor whether remote login brute force behavior exists based on the network address corresponding to the remote login and the login failure parameter value.

[0118] Based on any one of the above embodiments, the login failure parameter value includes a login failure number and a login failure frequency, and the preset failure parameter value includes a preset login failure number and a preset login failure frequency; the login failure parameter value being greater than the preset failure parameter value includes that the login failure number is greater than the preset login failure number and / or the login failure frequency is greater than the preset login failure frequency; and the monitoring unit 702 is further specifically configured to:

[0119] obtain login state information in the login behavior information;

[0120] in the case that the login state information is login failure, add one to a historical login failure number to obtain the login failure number, record a login timestamp corresponding to the remote login, and determine the login failure frequency based on stored login timestamps corresponding to each historical login failure and the login timestamp corresponding to the remote login, the historical login corresponding to the historical login failure and the remote login being logins for a same network address.

[0121] According to any one of the above embodiments, the monitoring unit 702 is further specifically configured to:

[0122] send a login authentication request to the threat behavior identification engine, the login authentication request comprising the network address and the login failure frequency;

[0123] compare, by the threat behavior identification engine, the network address with historical legitimate network addresses to obtain a first comparison result, and compare the login failure frequency with a historical legitimate login frequency to obtain a second comparison result;

[0124] in a case where the first comparison result indicates that the network address is different from the historical legitimate network address, and the second comparison result indicates that the login failure frequency is greater than the historical legitimate login frequency, determine that a remote login brute force attack exists.

[0125] According to any one of the above embodiments, the login behavior information comprises login account information; the login authentication request further comprises the login account information; and the monitoring unit 702 is further specifically configured to:

[0126] compare, by the threat behavior identification engine, the login account information with historical legitimate account information to obtain a third comparison result;

[0127] in a case where the first comparison result indicates that the network address is different from the historical legitimate network address, the second comparison result indicates that the login failure frequency is greater than the historical legitimate login frequency, and the third comparison result indicates that the login account information does not match the historical legitimate account information, determine that a remote login brute force attack exists.

[0128] According to any one of the above embodiments, the target information further comprises the network connection behavior information; and the remote login brute force attack monitoring device 700 further comprises:

[0129] a second acquisition unit, configured to, in a case where the login failure parameter value is greater than a preset failure parameter value, and the network address is not acquired from the login behavior information and the RDP connection information, acquire, in the network connection behavior information, a network address corresponding to a preset port, and determine the network address corresponding to the preset port as the network address corresponding to the remote login, the preset port being a port used to represent a remote login.

[0130] According to any one of the above embodiments, the target information comprises the login behavior information and the network connection behavior information; and the monitoring unit 702 is further specifically configured to:

[0131] determine a login failure parameter value based on the login behavior information;

[0132] If the login failure parameter value is greater than the preset failure parameter value, the login behavior information does not include the network address corresponding to the remote login, and the RDP connection information corresponding to the remote login is not obtained through the ETW mechanism, the network address corresponding to the preset port is obtained from the network connection behavior information, and the network address corresponding to the preset port is used to determine the network address corresponding to the remote login, wherein the preset port is a port used to characterize the remote login.

[0133] Based on the network address corresponding to the remote login and the login failure parameter value, it is monitored whether there is any brute-force behavior in remote login.

[0134] Based on any of the above embodiments, the remote login riot behavior monitoring device 700 further includes:

[0135] The determining unit is used to determine a target duration when it is determined that remote login brute-force behavior exists, wherein the target duration is the duration during which communication between the device corresponding to the network address and the electronic device is blocked;

[0136] A storage unit is used to store the correspondence between the network address and the target duration in an anomaly list.

[0137] Figure 8 This is a schematic diagram of the physical structure of the electronic device provided in the embodiments of the present invention, such as... Figure 8 As shown, the electronic device may include a processor 810, a communications interface 820, a memory 830, and a communication bus 840, wherein the processor 810, communications interface 820, and memory 830 communicate with each other via the communication bus 840. The processor 810 can invoke logical instructions in the memory 830 to execute a remote login brute-force behavior monitoring method. This method includes: obtaining target information corresponding to remote login through the ETW mechanism of the operating system deployed on the electronic device; the target information includes at least two of the following: login behavior information, RDP connection information, and network connection behavior information; and monitoring whether remote login brute-force behavior exists based on at least two of the target information among the login behavior information, the RDP connection information, and the network connection behavior information.

[0138] In addition, the logic instructions in the memory 830 described above can be implemented in the form of software functional units and sold or used as independent products, and can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the parts that contribute to the prior art or parts of the technical solutions can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0139] In another aspect, the present application also provides a computer program product, which comprises a computer program, the computer program can be stored on a non-transitory computer readable storage medium, and the computer program can be executed by a processor to enable a computer to perform the remote login brute force behavior monitoring method provided by the above-mentioned methods, the method comprising: obtaining target information corresponding to remote login through the ETW mechanism of the operating system deployed on the electronic device, the target information comprising at least two of the following: login behavior information, RDP connection information and network connection behavior information; and monitoring whether there is a remote login brute force behavior based on at least two target information of the login behavior information, the RDP connection information and the network connection behavior information.

[0140] In another aspect, the present application also provides a computer program product, which comprises a computer program, the computer program can be stored on a non-transitory computer readable storage medium, and the computer program can be executed by a processor to enable a computer to perform the remote login brute force behavior monitoring method provided by the above-mentioned methods, the method comprising: obtaining target information corresponding to remote login through the ETW mechanism of the operating system deployed on the electronic device, the target information comprising at least two of the following: login behavior information, RDP connection information and network connection behavior information; and monitoring whether there is a remote login brute force behavior based on at least two target information of the login behavior information, the RDP connection information and the network connection behavior information.

[0141] The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed to multiple network units. Part or all of the modules can be selected to achieve the purposes of the embodiments according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0142] Through the description of the above embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software and the necessary general hardware platform, and of course can also be realized by hardware. Based on such understanding, the above technical solutions can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiments.

[0143] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement to part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for monitoring remote login brute-force behavior, characterized in that, Applied to electronic devices, the method includes: The target information corresponding to remote login is obtained through the ETW mechanism of the operating system deployed on the electronic device. The target information includes at least two of the following: login behavior information, RDP connection information, and network connection behavior information. Based on at least two types of target information among the login behavior information, the RDP connection information, and the network connection behavior information, monitor whether remote login brute-force behavior exists.

2. The remote login brute-force behavior monitoring method according to claim 1, characterized in that, The target information includes the login behavior information and the RDP connection information; The monitoring of whether remote login brute-force attacks exist is based on at least two types of target information among the login behavior information, the RDP connection information, and the network connection behavior information, including: Determine the login failure parameter value based on the login behavior information; If the login failure parameter value is greater than the preset failure parameter value and the login behavior information does not include the network address corresponding to the remote login, the network address is obtained from the RDP connection information. Based on the network address corresponding to the remote login and the login failure parameter value, it is monitored whether there is any brute-force behavior in remote login.

3. The remote login brute-force behavior monitoring method according to claim 2, characterized in that, The login failure parameter values ​​include the number of login failures and the login failure frequency, and the preset failure parameter values ​​include the preset number of login failures and the preset login failure frequency. The login failure parameter value being greater than the preset failure parameter value includes: the number of login failures being greater than the preset number of login failures, and / or, the login failure frequency being greater than the preset login failure frequency; Determining the login failure parameter value based on the login behavior information includes: Obtain the login status information from the login behavior information; If the login status information indicates a login failure, increment the historical login failure count by one to obtain the login failure count, record the login timestamp corresponding to the remote login, and determine the login failure frequency based on the stored login timestamps corresponding to each historical login failure and the login timestamp corresponding to the remote login. The historical logins corresponding to the historical login failures and the remote logins are logins targeting the same network address.

4. The remote login brute-force behavior monitoring method according to claim 3, characterized in that, The monitoring of whether remote login brute-force attacks exist based on the network address and the login failure parameter value includes: Send a login authentication request to the threat behavior recognition engine, the login authentication request including the network address and the login failure frequency; The threat behavior recognition engine compares the network address with historical legitimate network addresses to obtain a first comparison result, and compares the login failure frequency with historical legitimate login frequency to obtain a second comparison result. If the first comparison result indicates that the network address is different from the historical legitimate network address, and the second comparison result indicates that the login failure frequency is greater than the historical legitimate login frequency, then it is determined that there is a remote login brute-force attack.

5. The remote login brute-force behavior monitoring method according to claim 4, characterized in that, The login behavior information includes login account information; the login authentication request also includes the login account information. The step of determining that remote login brute-force behavior exists when the first comparison result indicates that the network address and the historical legitimate network address are different, and the second comparison result indicates that the login failure frequency is greater than the historical legitimate login frequency, includes: The threat behavior recognition engine compares the login account information with historical legitimate account information to obtain a third comparison result; If the first comparison result indicates that the network address is different from the historical legitimate network address, the second comparison result indicates that the login failure frequency is greater than the historical legitimate login frequency, and the third comparison result indicates that the login account information does not match the historical legitimate account information, then it is determined that there is a remote login brute-force attack.

6. The remote login brute-force behavior monitoring method according to claim 2, characterized in that, The target information also includes the network connection behavior information; the method further includes: If the login failure parameter value is greater than the preset failure parameter value, and the network address is not obtained from the login behavior information and the RDP connection information, the network address corresponding to the preset port is obtained from the network connection behavior information, and the network address corresponding to the preset port is used to determine the network address corresponding to the remote login. The preset port is a port used to represent remote login.

7. The remote login brute-force behavior monitoring method according to claim 1, characterized in that, The target information includes the login behavior information and the network connection behavior information; The monitoring of whether remote login brute-force attacks exist is based on at least two types of target information among the login behavior information, the RDP connection information, and the network connection behavior information, including: Determine the login failure parameter value based on the login behavior information; If the login failure parameter value is greater than the preset failure parameter value, the login behavior information does not include the network address corresponding to the remote login, and the RDP connection information corresponding to the remote login is not obtained through the ETW mechanism, the network address corresponding to the preset port is obtained from the network connection behavior information, and the network address corresponding to the preset port is used to determine the network address corresponding to the remote login, wherein the preset port is a port used to characterize the remote login. Based on the network address corresponding to the remote login and the login failure parameter value, it is monitored whether there is any brute-force behavior in remote login.

8. The remote login brute-force behavior monitoring method according to any one of claims 2-7, characterized in that, The method further includes: If a remote login brute-force attack is confirmed, a target duration is determined, which is the duration during which communication between the device corresponding to the network address and the electronic device is blocked. The correspondence between the network address and the target duration is stored in the anomaly list.

9. A remote login riot behavior monitoring device, characterized in that, include: The first acquisition unit is used to acquire target information corresponding to remote login through the ETW mechanism of the operating system deployed on the electronic device. The target information includes at least two of the following: login behavior information, RDP connection information, and network connection behavior information. The monitoring unit is used to monitor whether remote login brute-force behavior exists based on at least two types of target information among the login behavior information, the RDP connection information, and the network connection behavior information.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the remote login brute-force behavior monitoring method as described in any one of claims 1 to 8.

11. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the remote login brute-force behavior monitoring method as described in any one of claims 1 to 8.

12. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the remote login brute-force behavior monitoring method as described in any one of claims 1 to 8.

Images