Abnormal login behavior tracing system and method
By introducing a honey hole traceability system into the abnormal login behavior traceability system, and using the sticky procedure to collect information on suspicious target devices, the problem of insufficient information in the existing traceability solution is solved, and more detailed and accurate threat intelligence acquisition is achieved.
Patent Information
- Application Number
- CN202411551037.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-01
- Publication Date
- 2025-02-11
AI Technical Summary
The existing abnormal login behavior traceability scheme is very limited and inaccurate when obtaining traceability information, and cannot obtain more detailed and accurate information.
A traceability system for abnormal login behavior is designed, including login authentication system and Midong traceability system. The Midong Traceability System sends sticking procedures to suspicious target devices by triggering signal reception, signal processing, program delivery and sticking procedures, collects equipment and network information, and returns it to the traceability system.
By directly collecting information on suspicious target devices, more detailed and accurate threat intelligence is provided, which significantly improves the richness and accuracy of traceability information compared with existing solutions.
Smart Images
Figure CN119420541A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of abnormal login processing, and in particular to a system and method for tracing abnormal login behavior. Background Art
[0002] In cyberspace, when users request services, they usually need to provide authentication credentials to the identity authentication system to prove that they are legitimate users. After confirming that the credentials are legitimate, the identity authentication system assigns a digital identity to the user. The authentication system then determines whether the user has the authority to perform the requested service based on the user's data identity. When there are abnormalities in the identity authentication or authentication results, the system usually records the abnormal login so that operation and maintenance personnel can trace the abnormal behavior and conduct analysis.
[0003] Existing solutions for tracing the source of abnormal login behavior are usually located in the authentication / authorization system that provides the service. For example, abnormal login behavior and its associated IP addresses, user information, etc. are recorded through firewalls, security gateways, security logs, etc. There is no tracing method that delivers sticky programs to suspicious user devices to obtain information related to abnormal login behavior.
[0004] The existing traceability solutions only provide very limited and usually inaccurate traceability information for abnormal login behaviors, because the existing solutions only deploy security devices on the service provider side and can only analyze the content of HTTP / HTTPS requests issued by users when they log in / request services. The information that can be obtained is very limited, including the IP address of the user when making the request, the credentials submitted, the requested service, etc., and no other more accurate and granular information can be obtained.
[0005] Therefore, it is necessary to provide an abnormal login behavior tracing system to solve the above technical problems. Summary of the invention
[0006] The present invention provides an abnormal login behavior tracing system, which solves the problem that the tracing information of abnormal login behavior is very limited.
[0007] In order to solve the above technical problems, the present invention provides an abnormal login behavior tracing system, comprising:
[0008] A login authentication system and a honey hole tracing system, wherein the honey hole tracing system comprises a trigger signal receiving module, a signal processing module, a program delivery module, a sticky program and a return data receiving module, wherein the delivery end of the login authentication system is connected to the input end of the trigger signal receiving module, the output end of the trigger signal receiving module is connected to the input end of the signal processing module, the output end of the signal processing module is connected to the input end of the program delivery module and the sticky program, and the output end of the information collection module and the data return module is connected to the input end of the sticky program;
[0009] The inside of the sticky program is respectively provided with an information collection module and a data return module.
[0010] Preferably, the program delivery module and the delivery end of the sticky program are connected to a suspicious target.
[0011] Preferably, the output end of the feedback data receiving module is wirelessly connected to the suspicious target tracing information.
[0012] Preferably, the trigger signal receiving module is used to receive the alarm signal from the login authentication system and pass the alarm signal to the signal processing module. When abnormal login behavior, authority abnormality, inconsistent authentication results of multiple authentication components, etc. occur, the login authentication system will send relevant abnormalities and user information to the honeyhole traceability system, thereby triggering the honeyhole traceability mechanism.
[0013] Preferably, the signal processing module is used to parse the basic data of suspicious user information, network location, and device system information in the alarm information, and pass it to the program delivery module for delivering a suitable sticky program to the suspicious target.
[0014] Preferably, the program delivery module is used to prepare the sticky program of the corresponding platform and the corresponding version according to the basic information of the suspicious target, and deliver the sticky program to the suspicious target device through an appropriate channel.
[0015] Preferably, the sticky program is used to automatically run after being delivered to the suspicious target device, collect relevant information of the suspicious target, and transmit the collected suspicious target information back to the honey hole tracing system.
[0016] Preferably, the information collection module is used to scan and collect the device information, network information, account information, and service information of the suspicious target device.
[0017] Preferably, the data feedback module is used to establish a communication channel from the sticky program to the honeyhole tracing system, package the collected information and return it to the honeyhole tracing system.
[0018] A method for tracing the source of abnormal login behavior, comprising the following steps:
[0019] S1. First, when an abnormality occurs, the login authentication system transmits the abnormal login behavior information as a trigger signal to the honeyhole tracing system;
[0020] S2. Secondly, after receiving the trigger signal, the signal processing module of the honeyhole tracing system analyzes the abnormal login behavior information contained in the trigger signal and passes the relevant information to the program delivery module;
[0021] S3, after the program delivery module receives the signal in S2, the program delivery module prepares a suitable sticky program according to the system information of the suspicious user device, and delivers the sticky program to the suspicious target device;
[0022] S4. Then, the sticky program runs on the suspicious target device, collects relevant information about the device and network environment, and transmits this information back to the honeyhole tracing system;
[0023] S5. The honeyhole tracing system receives and transmits back the relevant information of the suspicious target, parses and associates it with the abnormal login behavior and the suspicious target, and outputs the tracing information of the suspicious target as threat intelligence.
[0024] Compared with related technologies, the abnormal login behavior tracing system provided by the present invention has the following beneficial effects:
[0025] The present invention provides an abnormal login behavior tracing system. When an abnormal login authentication system occurs, a sticky program that collects user information is delivered to a suspicious target device, and the device information, network information, account information, and service information of the suspicious target are scanned and collected and then transmitted back to the honeyhole tracing system. Since the transmitted suspicious target information is directly collected on the suspicious target device, more detailed and accurate threat intelligence can be obtained compared to the existing solution that only deploys security devices on the login service side. The existing tracing solution has very limited tracing information for abnormal login behavior, and can only record information such as the abnormally logged-in user, IP address, and requested service as a security log. BRIEF DESCRIPTION OF THE DRAWINGS
[0026] Figure 1 A schematic diagram of a preferred embodiment of an abnormal login behavior tracing system provided by the present invention;
[0027] Figure 2 This is an example of the operation of the abnormal login behavior tracing method based on sticky program delivery.
[0028] Numbers in the figure: 1. Login authentication system; 2. Honeyhole tracing system; 3. Trigger signal receiving module; 4. Signal processing module; 5. Program delivery module; 6. Sticky program; 7. Information collection module; 8. Data return module; 9. Return data receiving module. DETAILED DESCRIPTION
[0029] The present invention will be further described below in conjunction with the accompanying drawings and implementation modes.
[0030] First embodiment
[0031] Please refer to Figure 1 and Figure 2 ,in, Figure 1A schematic diagram of a preferred embodiment of an abnormal login behavior tracing system provided by the present invention; Figure 2 This is an example of the operation of an abnormal login behavior tracing method based on sticky program delivery. An abnormal login behavior tracing system includes:
[0032] A login authentication system 1 and a honey hole tracing system 2, wherein the honey hole tracing system 2 comprises a trigger signal receiving module 3, a signal processing module 4, a program delivery module 5, a sticky program 6 and a return data receiving module 9, wherein the delivery end of the login authentication system 1 is connected to the input end of the trigger signal receiving module 3, the output end of the trigger signal receiving module 3 is connected to the input end of the signal processing module 4, the output end of the signal processing module 4 is connected to the input end of the program delivery module 5 and the sticky program 6, and the output end of the information collection module 7 and the data return module 8 is connected to the input end of the sticky program 6;
[0033] The adhering program 6 is internally provided with an information collection module 7 and a data return module 8 .
[0034] The program delivery module 5 and the delivery end of the sticky program 6 are connected with a suspicious target.
[0035] The output end of the feedback data receiving module 9 is wirelessly connected to the suspicious target tracing information.
[0036] The trigger signal receiving module is used to receive the alarm signal from the login authentication system 1 and pass the alarm signal to the signal processing module 4. When abnormal login behavior, authority abnormality, inconsistent authentication results of multiple authentication components, etc. occur in the login authentication system 1, the relevant abnormality and user information will be sent to the honeyhole traceability system 2, thereby triggering the honeyhole traceability mechanism.
[0037] The signal processing module 4 is used to parse the basic data of suspicious user information, network location, and device system information in the alarm information, and pass it to the program delivery module 5 to deliver a suitable sticky program to the suspicious target.
[0038] The program delivery module 5 is used to prepare the sticky program 6 of the corresponding platform and the corresponding version according to the basic information of the suspicious target, and deliver the sticky program 6 to the suspicious target device through an appropriate channel.
[0039] For example, Windows, Linux, Mac, Android, etc., corresponding versions of sticky programs 6, and through appropriate channels such as Web services, ftp services, scp services, SMB services, etc.
[0040] The sticky program 6 is used to automatically run after being delivered to the suspicious target device, collect relevant information of the suspicious target, and return the collected suspicious target information to the honey hole tracing system 2.
[0041] The information collection module 7 is used to scan and collect the device information, network information, account information, and service information of the suspicious target device.
[0042] For example, device model, MAC address, IP address, operating system information, network environment, device user name, related credential storage, installed / started services, etc. This information can be used to trace the attack source of suspicious targets and determine the infrastructure, IP addresses, and IoC (Indicator of Compromise) and other threat intelligence involved in the attack.
[0043] The data return module 8 is used to establish a communication channel from the sticky program 6 to the honeyhole tracing system 2, and to package the collected information and return it to the honeyhole tracing system 2.
[0044] The feedback data receiving module 9 receives the feedback data from the sticky program 6, parses the collected information related to the suspicious target, associates the information with the suspicious target and abnormal login behavior, and outputs it as threat intelligence.
[0045] A method for tracing the source of abnormal login behavior, comprising the following steps:
[0046] S1. First, when an abnormality occurs, the login authentication system 1 transmits the abnormal login behavior information as a trigger signal to the honeyhole tracing system 2;
[0047] S2. Secondly, after receiving the trigger signal, the signal processing module 4 of the honey hole tracing system 2 analyzes the abnormal login behavior information contained in the trigger signal and transmits the relevant information to the program delivery module 5;
[0048] S3, after the program delivery module 5 receives the signal in S2, the program delivery module 5 prepares a suitable sticky program 6 according to the system information of the suspicious user device, and delivers the sticky program 6 to the suspicious target device;
[0049] S4, then, the sticky program 6 runs on the suspicious target device, collects relevant information about the device and the network environment, and transmits this information back to the honey hole tracing system 2;
[0050] S5. The honeyhole tracing system 2 receives and returns the suspicious target related information, parses and associates it with abnormal login behavior and suspicious targets, and outputs the suspicious target tracing information as threat intelligence.
[0051] This example shows how the honeyhole tracing system delivers sticky programs and performs source analysis when an external user accesses the intranet mail system. This example only focuses on the operation process of the honeyhole tracing system. You can adjust the appropriate sticky program delivery method and configure the information content collected by the sticky program based on specific abnormal login behavior, suspicious target device platform, operating system and other information.
[0052] Please refer to Figure 2 In the example, the operation process of the honeyhole traceability system is as follows:
[0053] A suspicious event occurs: an external user uses the Chrome browser on a Windows device to access the intranet mail system. The login authentication system 1 detects that the user accessing the intranet mail system is an external user, determines that the login is an abnormal login behavior, records the suspicious user name, IP address, client operating system type and other information, and passes it to the honeyhole tracing system 2;
[0054] The trigger signal receiving module 3 receives the information of the login authentication system 1, activates the honey hole tracing system 2, and transmits the received information to the signal processing module 4;
[0055] The signal processing module 4 analyzes the trigger signal and transmits the IP address of the suspicious target, the Windows operating system used, and the Chrome browser to the program delivery module;
[0056] The program delivery module 5 selects the corresponding sticky program 6 for the Windows system device according to the suspicious target, and logs in through the page using the Chrome browser according to the suspicious target. The program delivery module 5 uses the Web service to redirect the login page to the delivery page. The delivery page automatically downloads the sticky program 6 to the suspicious target device and runs the sticky program 6.
[0057] After the sticky program 6 is run, it is obtained that the device is located in a Windows domain with a domain name "example.local", the user name of the Windows system is user1, the nmap service is running on the device, and the IP and MAC address of the device and other information; the sticky program 6 packages this information and uploads it to the honeyhole tracing system 2.
[0058] The return data receiving module 9 parses the data uploaded by the sticky program 6, and outputs the abnormal login behavior, the IP and MAC addresses of the suspicious targets associated with the user name, the Windows domain and user information, and the running nmap service as the tracing information and threat intelligence of the abnormal login behavior.
[0059] The working principle of the abnormal login behavior tracing system provided by the present invention is as follows:
[0060] When in use, first, when an exception occurs, the login authentication system 1 passes the abnormal login behavior information as a trigger signal to the honeyhole traceability system 2. Secondly, after the honeyhole traceability system 2 receives the trigger signal, the signal processing module 4 parses the abnormal login behavior information contained in the trigger signal, and passes the relevant information to the program delivery module 5. After the program delivery module 5 receives the signal in S2, the program delivery module 5 prepares a suitable sticky program 6 according to the system information of the suspicious user device, and delivers the sticky program 6 to the suspicious target device. Then, the sticky program 6 runs on the suspicious target device, collects relevant information about the device and the network environment, and transmits this information back to the honeyhole traceability system 2. The honeyhole traceability system 2 receives the returned suspicious target related information, parses and associates it with the abnormal login behavior and the suspicious target, and outputs the suspicious target traceability information as threat intelligence.
[0061] Compared with related technologies, the abnormal login behavior tracing system provided by the present invention has the following beneficial effects:
[0062] The present invention provides an abnormal login behavior tracing system. When an abnormal login authentication system 1 occurs, a sticky program 6 that collects user information is delivered to a suspicious target device, and the device information, network information, account information, and service information of the suspicious target are scanned and collected and then transmitted back to a honey hole tracing system 2. Since the transmitted suspicious target information is directly collected on the suspicious target device, more detailed and accurate threat intelligence can be obtained compared to the existing scheme that only deploys security devices on the login service side. The existing tracing scheme obtains very limited tracing information for abnormal login behavior, and can only record information such as the abnormally logged-in user, IP address, and requested service as a security log.
[0063] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.
Claims
1. An abnormal login behavior tracing system, characterized in that: include: A login authentication system and a honey hole tracing system, wherein the honey hole tracing system comprises a trigger signal receiving module, a signal processing module, a program delivery module, a sticky program and a return data receiving module, wherein the delivery end of the login authentication system is connected to the input end of the trigger signal receiving module, the output end of the trigger signal receiving module is connected to the input end of the signal processing module, the output end of the signal processing module is connected to the input end of the program delivery module and the sticky program, and the output end of the information collection module and the data return module is connected to the input end of the sticky program; The inside of the sticky program is respectively provided with an information collection module and a data return module.
2. The abnormal login behavior tracing system according to claim 1 is characterized in that: The program delivery module and the delivery end of the sticky program are connected with a suspicious target.
3. The abnormal login behavior tracing system according to claim 1 is characterized in that: The output end of the return data receiving module is wirelessly connected to the suspicious target tracing information.
4. The abnormal login behavior tracing system according to claim 1 is characterized in that: The trigger signal receiving module is used to receive the alarm signal from the login authentication system and pass the alarm signal to the signal processing module. When abnormal login behavior, authority abnormality, inconsistent authentication results of multiple authentication components, etc. occur, the login authentication system will send the relevant abnormalities and user information to the honeyhole traceability system, thereby triggering the honeyhole traceability mechanism.
5. The abnormal login behavior tracing system according to claim 1 is characterized in that: The signal processing module is used to parse the basic data of suspicious user information, network location, and device system information in the alarm information, and pass it to the program delivery module to deliver a suitable sticky program to the suspicious target.
6. The abnormal login behavior tracing system according to claim 1 is characterized in that: The program delivery module is used to prepare the sticky program of the corresponding platform and corresponding version according to the basic information of the suspicious target, and deliver the sticky program to the suspicious target device through an appropriate channel.
7. The abnormal login behavior tracing system according to claim 1 is characterized in that: The sticky program is used to automatically run after being delivered to the suspicious target device, collect relevant information of the suspicious target, and transmit the collected suspicious target information back to the honey hole tracing system.
8. The abnormal login behavior tracing system according to claim 1 is characterized in that: The information collection module is used to scan and collect the device information, network information, account information, and service information of the suspicious target device.
9. The abnormal login behavior tracing system according to claim 1 is characterized in that: The data return module is used to establish a communication channel from the sticky program to the honeyhole tracing system, package the collected information and return it to the honeyhole tracing system.
10. A method for tracing the source of abnormal login behavior, characterized in that: The following steps are involved: S1. First, when an abnormality occurs, the login authentication system transmits the abnormal login behavior information as a trigger signal to the honeyhole tracing system; S2. Secondly, after receiving the trigger signal, the signal processing module of the honeyhole tracing system analyzes the abnormal login behavior information contained in the trigger signal and passes the relevant information to the program delivery module; S3, after the program delivery module receives the signal in S2, the program delivery module prepares a suitable sticky program according to the system information of the suspicious user device, and delivers the sticky program to the suspicious target device; S4. Then, the sticky program runs on the suspicious target device, collects relevant information about the device and network environment, and transmits this information back to the honeyhole tracing system; S5. The honeyhole tracing system receives and transmits back the relevant information of the suspicious target, parses and associates it with the abnormal login behavior and the suspicious target, and outputs the tracing information of the suspicious target as threat intelligence.