A method and device for active perception brute force cracking based on cloud computing

Abstract

The present invention provides a method and device for actively sensing brute force cracking based on cloud computing, which belongs to the technical field of electronic digital data processing. The method includes: obtaining an input string when a user accesses target information; based on cloud computing technology and according to the input string, actively sensing the user's brute force cracking behavior, and obtaining the compliance determination result of the user's behavior; when the compliance determination result is compliant, responding to the service request according to the input string; when the compliance determination result is non-compliant, triggering an internal warning. The method and device for actively sensing brute force cracking based on cloud computing of the present invention introduces cloud computing, obtains the compliance determination result of the user's behavior according to the input string, and allows the user to access the corresponding target information when it is determined that the user has not subjected to brute force cracking; if the user has subjected to brute force cracking, a system internal warning is triggered, and the security and response speed of the system are improved through active verification and dynamic response mechanisms.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic digital data processing, and in particular to a method and device for active perception brute force cracking based on cloud computing. Background Art

[0002] Brute force attack is a method of attack that attempts to crack passwords, encryption keys or other security measures by trying all possible combinations. Existing security measures against brute force attacks usually include password attempt limits and basic anomaly detection, but these methods often respond only after multiple failed attempts and are slow to respond, which cannot effectively prevent brute force attacks. Alternatively, the system does not issue warnings when it is attacked, and brute force attacks cannot be identified and prevented in a timely manner, further reducing the security of access to platform information.

[0003] In view of this, there is an urgent need for a method and device for active perception of brute force cracking based on cloud computing to at least solve the above-mentioned shortcomings. Summary of the invention

[0004] One of the purposes of the present invention is to provide a method and device for actively perceiving brute force cracking based on cloud computing, obtain an input string for access verification when a user accesses target information, introduce cloud computing, perceive the user's brute force cracking behavior based on the input string, obtain the compliance determination result of the user's behavior, and when it is determined that the user does not have brute force cracking, allow the user to access the corresponding target information; if the user has brute force cracking, trigger an internal system warning, and improve the security and response speed of the system through active verification and dynamic response mechanisms.

[0005] An embodiment of the present invention provides a method for active perception brute force cracking based on cloud computing, comprising:

[0006] Step 1: Obtain the input string used for verification when the user accesses the target information;

[0007] Step 2: Based on cloud computing technology and input string, the user's brute force cracking behavior is actively sensed to obtain the compliance judgment result of the user's behavior;

[0008] Step 3: If the compliance determination result is compliance, it is determined that the user does not engage in brute force cracking and responds to the service request according to the input string;

[0009] Step 4: When the compliance determination result is non-compliant, an internal warning is triggered.

[0010] Preferably, obtaining an input string for verification when a user accesses target information includes:

[0011] Determine the access platform for target information;

[0012] Gets the input string entered by the user when accessing the target information on the access platform.

[0013] Preferably, based on cloud computing technology and according to the input string, the user's brute force cracking behavior is actively sensed to obtain the compliance determination result of the user's behavior, including:

[0014] Get the preset verification algorithm;

[0015] Based on the preset verification algorithm and input string, the system actively senses the user's brute force cracking behavior and obtains the compliance judgment result of the user's behavior.

[0016] Preferably, based on cloud computing technology and according to the input string, actively sensing the user's brute force cracking behavior and obtaining the compliance determination result of the user's behavior also includes:

[0017] Based on the preset verification strategy library, select the verification strategy, which is: target verification algorithm and verification bit;

[0018] Based on the verification strategy and input string, the system actively senses the user's brute force cracking behavior and obtains the compliance judgment result of the user's behavior.

[0019] Preferably, based on a preset verification strategy library, a verification strategy is selected, including:

[0020] Get the historical verification string of the pre-selected verification strategy;

[0021] Based on a preset string feature extraction template, extract the first string feature of the historical verification string and construct a first string feature factor; the string feature includes: string length and character type;

[0022] Extracting a second string feature of the input string according to the string feature extraction template, and constructing a second string feature factor;

[0023] Calculate a character string feature factor similarity value according to the first character string feature factor and the second character string feature factor;

[0024] Obtain the verification success rate and verification time of the pre-selected verification strategy;

[0025] The string feature factor similarity values, verification success rate and verification time are normalized to obtain the selection value of the pre-selected verification strategy, and the pre-selected verification strategy with the largest selection value is used as the verification strategy.

[0026] Preferably, when the compliance determination result is non-compliant, an internal warning is triggered, including:

[0027] When the compliance determination result is non-compliant, determine whether the total number of non-compliant requests within a preset time period after the first non-compliant request determined to be non-compliant occurs is greater than a preset non-compliant request number threshold;

[0028] If so, the corresponding user is judged to have engaged in brute force hacking, the corresponding user is blocked, and an internal warning is directly triggered;

[0029] If not, the corresponding user will be regarded as a suspicious user, and the suspicious user information and verification log will be recorded;

[0030] Send suspicious user information and verification logs to the security audit node. After the security audit node sends the completed audit report to the decision node, it obtains the decision information of the decision node.

[0031] Based on the decision information, determine whether to trigger an internal warning.

[0032] An embodiment of the present invention provides a method for active perception brute force cracking based on cloud computing, further comprising:

[0033] Build automatic audit nodes based on historical audit reports;

[0034] When the node load of the security audit node is greater than the preset node load threshold, the automatic audit node assists in issuing an audit report.

[0035] Preferably, according to the historical audit report, an automatic audit node is built, including:

[0036] Extract audit items from historical audit reports based on character extraction technology;

[0037] Mark the audit items and the audit time of the corresponding historical audit reports on a preset time axis to obtain a first marking point and a first marking item;

[0038] Compare audit items at different audit times to obtain overlapping audit items;

[0039] Mark the current moment on the timeline to obtain the second marking point;

[0040] Acquire the first marking items of the first marking points of a preset target number before the second marking point, and use them as the second marking items;

[0041] Eliminate the overlapping audit items in the second marked item and perform audit item deduplication to obtain the third marked item;

[0042] The third marked item and the overlapping audit item are taken together as the current audit item;

[0043] Build an automatic audit node based on the current audit items.

[0044] Preferably, according to the current audit item, an automatic audit node is built, including:

[0045] Get the extraction link of the audit content corresponding to the current audit item;

[0046] Obtain link attributes of the extracted link and extract link features;

[0047] According to the link characteristics and the preset link characteristics-reliability value determination table, the reliability value of the extracted link is obtained;

[0048] Train the audit item evaluation model based on the historical audit content of the current audit item;

[0049] Determine the target audit item evaluation model based on the reliability value and audit item evaluation model;

[0050] Build an automatic audit node based on the extraction link and target audit item evaluation model.

[0051] An embodiment of the present invention provides a cloud computing-based active perception brute force cracking device, comprising:

[0052] An input string acquisition subsystem is used to acquire an input string used for verification when a user accesses target information;

[0053] The compliance determination result determination subsystem is used to actively perceive the user's brute force cracking behavior based on the cloud computing technology and the input string, and obtain the compliance determination result of the user's behavior;

[0054] The business request response subsystem is used to determine that the user does not engage in brute force cracking when the compliance determination result is compliance, and respond to the business request according to the input string;

[0055] The warning trigger subsystem is used to trigger an internal warning when the compliance judgment result is non-compliant.

[0056] The beneficial effects of the present invention are:

[0057] The present invention obtains an input string for access verification when a user accesses target information, introduces cloud computing, perceives the user's brute force cracking behavior based on the input string, obtains the compliance determination result of the user's behavior, and allows the user to access the corresponding target information when it is determined that the user has not performed brute force cracking; if the user has performed brute force cracking, an internal system warning is triggered, and the security and response speed of the system are improved through active verification and dynamic response mechanisms.

[0058] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures specifically pointed out in the present application documents.

[0059] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0061] Figure 1 A schematic diagram of a method for active perception brute force cracking based on cloud computing in an embodiment of the present invention;

[0062] Figure 2 The figure is a schematic diagram of a cloud computing-based active perception brute force cracking device in an embodiment of the present invention. DETAILED DESCRIPTION

[0063] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0064] The embodiment of the present invention provides a method for active perception brute force cracking based on cloud computing, such as Figure 1 As shown, including:

[0065] Step 1: Obtain the input string used for verification when the user accesses the target information; the target information is: information that the platform prevents malicious users from accessing, such as: ID number, redemption code and bank card number;

[0066] Step 2: Based on cloud computing technology and input string, actively sense the user's brute force cracking behavior and obtain the compliance determination result of the user's behavior; wherein, actively sense the user's brute force cracking behavior specifically includes: judging whether the user has brute force cracking behavior based on the string verification result, and brute force cracking behavior specifically includes: attempting to access or obtain system sensitive information by randomly generating information; the compliance determination result is: user behavior compliance and user behavior non-compliance, user behavior compliance means that the input string verification passes (for example: the input access password is consistent with the preset password), and non-compliance means that the input string verification fails;

[0067] Step 3: When the compliance determination result is compliance, it is determined that the user does not have brute force cracking behavior, and responds to the service request according to the input string; wherein the service request is: a service request for verifying the input characters, for example: the input string is the login password of the government platform, then the service request is: the resident information corresponding to the login password account stored in the government platform;

[0068] Step 4: When the compliance determination result is non-compliant, an internal warning is triggered. The internal warning is triggered when the total number of non-compliant requests within the preset time (for example, within 30 minutes) after the first non-compliant request is greater than or equal to the preset non-compliant request number threshold (the preset non-compliant request number threshold is manually preset), the user is judged to have brute force hacking behavior, and an alarm message is generated. When the total number of non-compliant requests within the preset time after the first non-compliant request is less than the preset non-compliant request number threshold, the system stores the log and uploads the stored log to the security audit node. The security audit node generates an audit report and sends it to the decision node. The security audit node is: the network node of the network security auditor; the decision node is: the network node of the administrator who decides whether the behavior of the suspicious user is brute force hacking behavior.

[0069] The working principle and beneficial effects of the above technical solution are:

[0070] The present invention obtains an input string for access verification when a user accesses target information, introduces cloud computing, perceives the user's brute force cracking behavior based on the input string, obtains the compliance determination result of the user's behavior, and allows the user to access the corresponding target information when it is determined that the user has not performed brute force cracking; if the user has performed brute force cracking, an internal system warning is triggered, and the security and response speed of the system are improved through active verification and dynamic response mechanisms.

[0071] In one embodiment, obtaining an input string for verification when a user accesses target information includes:

[0072] Determine an access platform for target information; wherein the access platform is: a platform that provides an access interface for target information;

[0073] Gets the input string entered by the user when accessing the target information on the access platform.

[0074] The working principle and beneficial effects of the above technical solution are:

[0075] The present invention introduces an access platform for target information, and obtains an input string input by a user when accessing the target information based on the access platform, thereby improving the reliability of obtaining the input string.

[0076] In one embodiment, based on cloud computing technology and according to the input string, the user's brute force cracking behavior is actively sensed to obtain the compliance determination result of the user's behavior, including:

[0077] Obtain a preset verification algorithm; wherein the preset verification algorithm is manually preset, specifically: an algorithm for verifying whether the input string entered by the user meets the input requirements;

[0078] According to the preset verification algorithm and input string, the user's brute force cracking behavior is actively sensed to obtain the compliance determination result of the user's behavior; wherein, when the verification is performed according to the verification algorithm and the input string, if the check digit determined by the verification algorithm of the input string is consistent with the preset check value, the verification passes and the compliance determination result is compliant, otherwise it is not compliant;

[0079] The preset verification algorithms include:

[0080] Extract the first digits of the input string, multiply them by a coefficient, then add them up, and finally take the modulus of 16. The remainder is the value of the last digit. The coefficient is used to adjust the value of the calculation result and is set by the algorithm designer.

[0081] and / or,

[0082] Extract the first digits of the input string and add them up, then multiply them by a coefficient, and finally take the modulus of 16. The remainder is the value of the last digit.

[0083] and / or,

[0084] Take the value of the middle digits and multiply it by a certain coefficient, modulo 16, and the remainder is the value of the last digit;

[0085] and / or,

[0086] Take out the value at every other digit, perform the operation and take the modulus of 16, the remainder is the value of the last digit;

[0087] Among them, the last digit is the check digit.

[0088] The working principle and beneficial effects of the above technical solution are:

[0089] The present invention introduces a verification algorithm and quickly performs active verification of an input string according to the verification algorithm, specifically including: determining a check digit according to a preset verification algorithm and the input string, comparing an actual check digit with a preset check digit, if the check values ​​are consistent, the verification passes, and a compliance determination result is compliance, otherwise non-compliance; through active verification and a dynamic response mechanism, the security and response speed of the system are improved.

[0090] In one embodiment, based on cloud computing technology and according to an input string, the brute force cracking behavior of the user is actively sensed, and the compliance determination result of the user behavior is obtained, which also includes:

[0091] Based on the preset verification strategy library, a verification strategy is selected, and the verification strategy is: a target verification algorithm and a check bit; wherein the verification strategy library includes a plurality of pre-selected verification strategies, and the pre-selected verification strategy is: a verification algorithm and a check bit for verification used for the transmitted character string that are manually preset and stored in the database; the selected verification strategy is: a pre-selected verification strategy suitable for the user input character string;

[0092] According to the verification strategy and input string, the user's brute force cracking behavior is actively sensed to obtain the compliance determination result of the user's behavior. Specifically, the user's brute force cracking behavior is actively sensed according to the verification strategy and input string as follows: bitwise operation is performed on the input characters according to the target verification algorithm, and then verification is performed according to the verification bit selected in the verification strategy, and the compliance determination result of the user's behavior is obtained according to different verification results.

[0093] The working principle and beneficial effects of the above technical solution are:

[0094] The present invention introduces a verification strategy library, which includes multiple pre-selected verification strategies. The pre-selected verification strategies include: different character bit operation algorithms and different check bits, screening verification strategies suitable for input string processing, performing string processing according to the verification strategy, and selecting the verification strategy according to the adaptability of the input string, thereby improving the suitability of the verification and further improving the recognition accuracy of the active perception brute force cracking subject.

[0095] In one embodiment, based on a preset verification strategy library, a verification strategy is selected, including:

[0096] Obtain a historical verification string of a pre-selected verification strategy; wherein the historical verification string is: a string that was verified using the pre-selected verification strategy in history;

[0097] Based on a preset string feature extraction template, extract the first string feature of the historical verification string, and construct a first string feature factor; the string feature includes: string length and character type; wherein the preset string feature extraction template is: a template for extracting string features by comparing the historical verification string, such as: a method rule for extracting string length by comparing the historical verification string; character types include: uppercase letters, lowercase letters, numbers and special characters, etc.; the first string feature factor is: a character description vector constructed based on the first character feature;

[0098] According to the string feature extraction template, extract the second string feature of the input string, and construct a second string feature factor; wherein the second string feature factor is: a character description vector constructed based on the second character feature;

[0099] Calculate the string feature factor similarity value according to the first string feature factor and the second string feature factor; wherein the string feature factor similarity value is: the cosine value of the vector angle between the first string feature factor and the second string feature factor;

[0100] Obtain the verification success rate and verification duration of the pre-selected verification strategy; wherein the verification success rate is: 1 minus the false detection rate recorded in the history of the pre-selected verification strategy; the verification duration is: the verification operation duration;

[0101] The string feature factor similarity values, verification success rate and verification time are normalized to obtain the selection value of the pre-selected verification strategy, and the pre-selected verification strategy with the largest selection value is used as the verification strategy.

[0102] The working principle and beneficial effects of the above technical solution are:

[0103] The present invention obtains historical verification strings in the history of pre-selected verification strategies, and in addition, introduces a string feature extraction template to extract a first string feature of the historical verification string and construct a first string feature factor; introduces a string feature extraction template to extract a second string feature of an input string and constructs a second string feature factor; calculates a string feature factor similarity value between the first string feature factor and the second string feature factor; in addition, obtains a verification success rate and a verification duration of the pre-selected verification strategy, performs data normalization processing on the string feature factor similarity value, the verification success rate and the verification duration, obtains a selection value of the pre-selected verification strategy, and uses the pre-selected verification strategy with the largest selection value as the verification strategy, thereby improving the selection accuracy of the verification strategy.

[0104] In one embodiment, when the compliance determination result is non-compliant, an internal warning is triggered, including:

[0105] When the compliance determination result is non-compliant, determine whether the total number of non-compliant requests within a preset time period after the first non-compliant request determined to be non-compliant occurs is greater than a preset non-compliant request number threshold;

[0106] If so, the corresponding user is judged to have engaged in brute force hacking, the corresponding user is blocked, and an internal warning is directly triggered;

[0107] If not, the corresponding user will be regarded as a suspicious user, and the suspicious user information and verification log will be recorded; the suspicious user information includes: user IP and user ID;

[0108] Send suspicious user information and verification logs to the security audit node. After the security audit node sends the completed audit report to the decision node, it obtains the decision information of the decision node.

[0109] Based on the decision information, determine whether to trigger an internal warning.

[0110] The working principle and beneficial effects of the above technical solution are:

[0111] When users enter verification information to access information, they may forget their passwords and other situations. In this case, users may enter incorrect input characters, resulting in failure of the compliance check. However, after real users try and fail, they will often try to access successfully a small number of times or log in through other reserved methods (such as sending verification codes through mobile phones). They will not try frequently after multiple failed attempts. In addition, it is not reasonable to directly judge users who fail the compliance check as brute force users. Therefore, a non-compliant request count threshold is introduced. When the total number of non-compliant requests within a preset time period after the first non-compliant request that is judged as non-compliant occurs is greater than the non-compliant request count threshold, the corresponding user is directly judged to be performing brute force, and an internal warning is issued to the administrator, and the IP of the corresponding user is blocked.

[0112] If the user has non-compliant input characters but has not exceeded the non-compliant request number threshold, the corresponding user will be regarded as a suspicious user, and the suspicious user information and verification log will be sent to the security audit node. The audit report completed by the security audit node will be obtained and delivered to the decision node. After viewing the report, the decision node will determine whether to identify the suspicious user as a brute force user, and determine whether to trigger an internal warning based on the judgment result, thereby improving the rationality of the brute force user judgment.

[0113] In one embodiment, when the compliance determination result is non-compliant, an internal warning is triggered, which also includes:

[0114] Before sending the suspicious user information and verification log to the security audit node, obtain the input string sequence of the suspicious user; wherein the input string sequence of the suspicious user is: a sequential sequence of non-compliant input strings of the suspicious user sorted by input time;

[0115] Obtain historical brute force cracking behavior records and extract string random generation rule sets;

[0116] Determine the first input string of the suspicious user in the input string sequence and use it as the target input string;

[0117] Determine a random generation sequence set according to a target input string and a string random generation rule set;

[0118] Based on the string input regularity characterization template, the string sequence and the randomly generated sequence in the random generated sequence set are characterized respectively; wherein the string input regularity characterization template is used to extract the string input regularity by comparing the string sequence, and the regularity feature is, for example: replacing the first character position in the order of 0-9 in sequence;

[0119] Perform regular feature matching on the first regular feature set corresponding to the input string sequence and the second regular feature set corresponding to the randomly generated sequence to obtain a matching degree; wherein the matching degree is: the regular matching degree between the string input regularity of the input string sequence and the string input regularity in the randomly generated sequence, for example: 96;

[0120] If there is a match greater than or equal to the preset match threshold, the suspicious user will be directly judged as a brute force cracking user and no subsequent audit will be conducted. The preset match threshold is manually set.

[0121] The working principle and beneficial effects of the above technical solution are:

[0122] The present invention obtains the input string sequence of the suspicious user before the audit is conducted when the number of non-compliance of the suspicious user does not reach the warning level and exceeds two times, extracts a known string random generation rule set according to the historical brute force cracking behavior records captured in the past, generates a random generation sequence set according to the string random generation rule set and the first input target input string in the input string sequence, introduces a string input regular characterization template, characterizes the sequences respectively, performs regular feature matching on the first regular feature set corresponding to the obtained input string sequence and the second regular feature set corresponding to the randomly generated sequence, and when the match is successful (there is a matching degree greater than or equal to a preset matching degree threshold), it indicates that the input string of the suspicious user can be directly judged to meet the randomly generated features without the need for subsequent manual auditing, which is more intelligent.

[0123] The embodiment of the present invention provides a method for active perception brute force cracking based on cloud computing, further comprising:

[0124] According to the historical audit reports, an automatic audit node is built; the automatic audit node is a network node of an AI model that automatically extracts the content of items (for example, 3 times) that require auditing of suspicious users (for example, the number of times they have been marked in the past month) and conducts audits;

[0125] When the node load of the security audit node is greater than the preset node load threshold, the automatic audit node assists in issuing an audit report. The node load is the maximum number of suspicious customers that the security audit node can review; the preset node load threshold is manually set in advance.

[0126] The working principle and beneficial effects of the above technical solution are:

[0127] When the platform serves a large number of users, the amount of audit tasks that can be processed by manually connected security audit nodes is limited. Therefore, the AI ​​audit model is connected, and the model learns the manual audit logic in the manual historical audit reports. When there is an overflow of audit tasks in the manual audit, the AI ​​audit model takes over, which improves the audit efficiency of suspicious users, avoids causing trusted users to wait too long, and improves the user service quality of the platform.

[0128] In one embodiment, according to the historical audit report, an automatic audit node is built, including:

[0129] Based on the character extraction technology, the audit items in the historical audit report are extracted; wherein the audit items are: the characters of the audit items extracted from the historical audit report;

[0130] Marking the audit items and the audit time of the corresponding historical audit reports on a preset time axis to obtain a first marking point and a first marking item; wherein the first marking point corresponds to a time point on the time axis one by one, and the first marking item is marked on the first marking point;

[0131] Compare audit items at different audit times to obtain overlapping audit items; overlapping audit items are: the common parts of audit items at different time points, which are obtained based on character matching technology;

[0132] Mark the current moment on the timeline to obtain the second marking point;

[0133] Obtaining the first marking items of the first marking points of a preset target number before the second marking point, and using them as the second marking items; wherein the preset target number is manually preset, for example: 5;

[0134] Eliminate the overlapping audit items in the second marked item and perform audit item deduplication to obtain the third marked item;

[0135] The third marked item and the overlapping audit item are taken together as the current audit item;

[0136] Build an automatic audit node based on the current audit items.

[0137] The working principle and beneficial effects of the above technical solution are:

[0138] The audit focuses in different periods are different. For example, the study found that the intention can be cracked by brute force through a certain behavior analysis of the user, and the behavior analysis can be used as an audit project. The focus of these different periods can obtain relevant information through the audit items in the manually compiled reports. Therefore, based on the character extraction technology, the audit items in the historical audit report are extracted, and the audit items and the audit time of the corresponding historical audit reports are marked on the preset timeline. At the same time, the current moment is also marked on the timeline to obtain the second marking point. The first marking item corresponding to the target number of first marking points before the second marking point is obtained as the second marking item, and the third marking item is obtained after deduplication. The third marking item and the overlapping audit item are used together as the current audit item. The audit item can be updated in real time based on the current moment, improving the reliability and real-time performance of automatic auditing.

[0139] In one embodiment, according to the current audit item, an automatic audit node is built, including:

[0140] Obtain an extraction link of the audit content corresponding to the current audit item; wherein the extraction link is: an acquisition path of the audit content corresponding to the current audit item, such as: a local user malicious behavior library access path, and another example: a user malicious behavior library access path of a big data node;

[0141] Obtain link attributes of the extracted link and extract link features; wherein link attributes are: link attribute information, including: link source information, link source screening information, etc.; link features are: feature representation of link attribute information, for example: link source feature value is: local or non-local; link source screening information feature value is: data sharing platform sharing list;

[0142] According to the link characteristics and the preset link characteristics-reliability value determination table, the reliability value of the extracted link is obtained; wherein the link characteristics-reliability value determination table includes one-to-one correspondence between pre-selected link characteristics and reliability values, which are manually set based on experience;

[0143] According to the historical audit content of the current audit item, the audit item evaluation model is trained; wherein the historical audit content of the current audit item can also be extracted from the historical audit report. When training the audit item evaluation model, the historical audit content is used as the model input, and the manual audit result of the input historical audit content in the historical audit report is used as the model output;

[0144] According to the reliability value and the audit item evaluation model, the target audit item evaluation model is determined; wherein the target audit item evaluation model is determined by: determining the downward adjustment channel of the output evaluation of the audit item evaluation model according to the reliability value, connecting the downward adjustment channel with the output channel of the audit item evaluation model, and obtaining the target audit item evaluation model. The higher the reliability value, the lower the downward adjustment degree of the downward adjustment channel.

[0145] According to the extraction link and the target audit item evaluation model, an automatic audit node is built. When building an automatic audit node, the extraction link and the target audit item evaluation model are connected according to the correlation relationship between the corresponding extracted and evaluated current audit items. After the connection is completed, the connection nodes are gathered to obtain the automatic audit node. When the automatic audit node is working, the extraction link corresponding to the project label is connected according to the project label of each current audit item. After the extraction link extracts the project content, the extracted content is input into the target audit item evaluation model corresponding to the project label. The model outputs the audit content based on the auxiliary audit template constructed based on the current audit item.

[0146] The working principle and beneficial effects of the above technical solution are:

[0147] The present invention obtains an extraction link of the audit content corresponding to the current audit item, obtains the link feature of the link attribute of the extraction link, introduces a link feature-reliability value determination table, performs feature matching on the link feature and the pre-selected link feature in the link feature-reliability value determination table, and determines the reliability value of the pre-selected link feature that meets the feature matching; according to the historical audit content and manual evaluation of the current audit item extracted from the historical audit report, the target audit item evaluation model is trained, the extraction link and the target audit item evaluation model are docked according to the correlation relationship of the corresponding extracted and evaluated current audit items, after the docking is completed, the docking nodes are aggregated to obtain the automatic audit node, the output of the target audit item evaluation model is corrected according to the reliability value of the extraction link of the audit content, and targeted training is performed according to the same audit item with different contents, which greatly improves the audit accuracy of the automatic audit node.

[0148] The embodiment of the present invention provides a device for actively sensing brute force cracking based on cloud computing, such as Figure 2 As shown, including:

[0149] An input string acquisition subsystem 1 is used to acquire an input string used for verification when a user accesses target information;

[0150] The compliance determination result determination subsystem 2 is used to actively perceive the user's brute force cracking behavior based on the cloud computing technology and the input string, and obtain the compliance determination result of the user's behavior;

[0151] The business request response subsystem 3 is used to determine that the user does not have brute force cracking behavior when the compliance determination result is compliance, and respond to the business request according to the input string;

[0152] The warning triggering subsystem 4 is used to trigger an internal warning when the compliance determination result is non-compliant.

[0153] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for active perception brute force cracking based on cloud computing, characterized in that: include: Get the input string used for verification when the user accesses the target information; Based on cloud computing technology and input string, it can actively perceive the user's brute force cracking behavior and obtain the compliance judgment result of the user's behavior; If the compliance judgment result is compliant, it is determined that the user does not engage in brute force cracking and responds to the business request according to the input string; When the compliance determination result is non-compliant, an internal warning is triggered; The method of actively sensing the brute force cracking behavior of the user based on the cloud computing technology and the input string, and obtaining the compliance determination result of the user behavior, further includes: Based on the preset verification strategy library, select the verification strategy, which is: target verification algorithm and verification bit; Based on the verification strategy and input string, the system proactively detects the user's brute force cracking behavior and obtains the compliance judgment result of the user's behavior. The verification strategy is selected based on the preset verification strategy library, including: Get the historical verification string of the pre-selected verification strategy; Based on a preset string feature extraction template, extract the first string feature of the historical verification string and construct a first string feature factor; the string feature includes: string length and character type; Extracting a second string feature of the input string according to the string feature extraction template, and constructing a second string feature factor; Calculate a character string feature factor similarity value according to the first character string feature factor and the second character string feature factor; Obtain the verification success rate and verification time of the pre-selected verification strategy; The string feature factor similarity values, verification success rate and verification time are normalized to obtain the selection value of the pre-selected verification strategy, and the pre-selected verification strategy with the largest selection value is used as the verification strategy.

2. The method for active perception brute force cracking based on cloud computing as claimed in claim 1, characterized in that: Get the input string used for verification when the user accesses the target information, including: Determine the access platform for target information; Gets the input string entered by the user when accessing the target information on the access platform.

3. The method for active perception brute force cracking based on cloud computing as claimed in claim 1, characterized in that: Based on cloud computing technology and input string, it actively senses the user's brute force cracking behavior and obtains the compliance judgment results of the user's behavior, including: Get the preset verification algorithm; Based on the preset verification algorithm and input string, the system actively senses the user's brute force cracking behavior and obtains the compliance judgment result of the user's behavior.

4. The method for active perception brute force cracking based on cloud computing as claimed in claim 1, characterized in that: When the compliance result is non-compliant, internal warnings are triggered, including: When the compliance determination result is non-compliant, determine whether the total number of non-compliant requests within a preset time period after the first non-compliant request determined to be non-compliant occurs is greater than a preset non-compliant request number threshold; If so, the corresponding user is judged to have engaged in brute force hacking, the corresponding user is blocked, and an internal warning is directly triggered; If not, the corresponding user will be regarded as a suspicious user, and the suspicious user information and verification log will be recorded; Send suspicious user information and verification logs to the security audit node. After the security audit node sends the completed audit report to the decision node, it obtains the decision information of the decision node. Based on the decision information, determine whether to trigger an internal warning.

5. The method for active perception brute force cracking based on cloud computing as claimed in claim 4, characterized in that: Also includes: Build automatic audit nodes based on historical audit reports; When the node load of the security audit node is greater than the preset node load threshold, the automatic audit node assists in issuing an audit report.

6. The method for active perception brute force cracking based on cloud computing as claimed in claim 5, characterized in that: According to the historical audit report, build an automatic audit node, including: Extract audit items from historical audit reports based on character extraction technology; Mark the audit items and the audit time of the corresponding historical audit reports on a preset time axis to obtain a first marking point and a first marking item; Compare audit items at different audit times to obtain overlapping audit items; Mark the current moment on the timeline to obtain the second marking point; Acquire the first marking items of the first marking points of a preset target number before the second marking point, and use them as the second marking items; Eliminate the overlapping audit items in the second marked item and perform audit item deduplication to obtain the third marked item; The third marked item and the overlapping audit item are taken together as the current audit item; Build an automatic audit node based on the current audit items.

7. The method for active perception brute force cracking based on cloud computing as claimed in claim 6, characterized in that: According to the current audit items, build an automatic audit node, including: Get the extraction link of the audit content corresponding to the current audit item; Obtain link attributes of the extracted link and extract link features; According to the link characteristics and the preset link characteristics-reliability value determination table, the reliability value of the extracted link is obtained; Train the audit item evaluation model based on the historical audit content of the current audit item; Determine the target audit item evaluation model based on the reliability value and audit item evaluation model; Build an automatic audit node based on the extraction link and target audit item evaluation model.

8. A cloud computing-based active perception brute force cracking device, characterized in that: include: An input string acquisition subsystem is used to acquire an input string used for verification when a user accesses target information; The compliance determination result determination subsystem is used to actively perceive the user's brute force cracking behavior based on the cloud computing technology and the input string, and obtain the compliance determination result of the user's behavior; The business request response subsystem is used to determine that the user does not engage in brute force cracking when the compliance determination result is compliance, and respond to the business request according to the input string; The warning trigger subsystem is used to trigger an internal warning when the compliance determination result is non-compliant; The compliance determination result determination subsystem is based on cloud computing technology and actively senses the user's brute force cracking behavior according to the input string, and obtains the compliance determination result of the user's behavior, and also includes: Based on the preset verification strategy library, select the verification strategy, which is: target verification algorithm and verification bit; Based on the verification strategy and input string, the system proactively detects the user's brute force cracking behavior and obtains the compliance judgment result of the user's behavior. The verification strategy is selected based on the preset verification strategy library, including: Get the historical verification string of the pre-selected verification strategy; Based on a preset string feature extraction template, extract the first string feature of the historical verification string and construct a first string feature factor; the string feature includes: string length and character type; Extracting a second string feature of the input string according to the string feature extraction template, and constructing a second string feature factor; Calculate a character string feature factor similarity value according to the first character string feature factor and the second character string feature factor; Obtain the verification success rate and verification time of the pre-selected verification strategy; The string feature factor similarity values, verification success rate and verification time are normalized to obtain the selection value of the pre-selected verification strategy, and the pre-selected verification strategy with the largest selection value is used as the verification strategy.

Images