Attack detection method and device, electronic equipment and medium

Abstract

The embodiment of the invention provides an attack detection method and device, electronic equipment and a medium. The attack detection method specifically comprises the following steps: receiving login request data; performing attack detection on the login request data according to matching information between login password information and historical password information in any time of login request data and the type number of abnormal password information corresponding to the login password information in N times of login request data, the historical password information is different from the accurate password information, but the user account is successfully logged in, or the historical password information is login password information that the user account is not successfully logged in, but the occurrence frequency or the occurrence frequency meets a preset frequent condition; the abnormal password information is not only different from accurate password information, but also different from historical password information. According to the embodiment of the invention, the condition that the legal IP address is misjudged as the illegal IP address can be reduced, and the misjudgment rate of the illegal IP address is reduced.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of Internet technology, and in particular to an attack detection method, device, electronic device, and medium. Background Art

[0002] With the widespread application of Internet technology, email has become an important communication tool for individuals and enterprises. The security of email accounts is crucial to information protection. Among network security threats, password brute force attacks have become one of the common network attack methods. Multi-IP (Internet Protocol) brute force attacks are a method of bypassing conventional risk control mechanisms to attempt to illegally log into an account. In this attack, the same email account will be attempted to log in by multiple different IP addresses.

[0003] The current attack detection method will count the corresponding number of failed login attempts when multiple IP addresses try to log in to an email account. If the number of failed login attempts exceeds a threshold, the security alarm system can be triggered to block multiple IP addresses.

[0004] In actual applications, if a legitimate user forgets his password, he may use multiple devices such as mobile phones, computers, and tablets to try to log in to his account. Since the IP addresses of multiple devices are usually different, when a legitimate user tries to log in to his account, it is possible that a security alarm will be triggered, resulting in the legitimate IP address being blocked. Therefore, the current attack detection method has the problem of legitimate IP addresses being misjudged as illegal IP addresses. Summary of the invention

[0005] The purpose of the embodiments of the present invention is to provide an attack detection method, device, electronic device, and medium, which can reduce the situation where a legitimate IP address is misjudged as an illegal IP address and reduce the misjudgment rate of illegal IP addresses.

[0006] The specific technical solutions are as follows:

[0007] In a first aspect of the present invention, an attack detection method is provided, the method comprising:

[0008] Receive login request data; the login request data includes: N login request data corresponding to N login processes, one login process generates one login request data, one login request data includes: user account, login password information and login IP; N is a positive integer;

[0009] Attack detection is performed on the login request data based on the matching information between the login password information and the historical password information in any login request data, and the number of types of abnormal password information corresponding to the login password information in N login request data; the historical password information is different from the accurate password information, but has successfully logged into the user account, or the historical password information is login password information that has not successfully logged into the user account, but the number of occurrences or the frequency of occurrences meets the preset frequent conditions; the abnormal password information is different from both the accurate password information and the historical password information.

[0010] In a second aspect of the present invention, an attack detection device is provided, the device comprising:

[0011] A receiving module, used to receive login request data; the login request data includes: N login request data corresponding to N login processes, one login process generates one login request data, one login request data includes: user account, login password information and login IP; N is a positive integer;

[0012] An attack detection module is used to perform attack detection on the login request data based on the matching information between the login password information and the historical password information in any login request data, and the number of types of abnormal password information corresponding to the login password information in N login request data; the historical password information is different from the accurate password information but has successfully logged into the user account, or the historical password information is the login password information that has not successfully logged into the user account but the number of occurrences or the frequency of occurrence meets the preset frequent condition; the abnormal password information is different from both the accurate password information and the historical password information.

[0013] In a third aspect of the present invention, there is also provided an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0014] Memory, used to store computer programs;

[0015] The processor is used to implement the aforementioned method steps when executing the program stored in the memory.

[0016] In a fourth aspect of the implementation of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium stores instructions, which, when executed on a computer, enable the computer to execute any of the above-described methods.

[0017] The attack detection method, device, electronic device and medium provided in the embodiments of the present invention perform attack detection on the above login request data based on the matching information between the login password information and the historical password information in any login request data, and the number of types of abnormal password information corresponding to the login password information in N login request data.

[0018] First, in the embodiment of the present invention, if the login password information is the same as the historical password that has been successfully logged into the user account, or is consistent with the historical password information that has not been successfully logged in but the number of times or frequency of occurrence meets the preset frequent conditions, the embodiment of the present invention will tend to believe that this may be the operation of a legitimate user, and will not be determined as an illegal login. Since the technical means of "based on the matching information between the login password information and the historical password information" in the embodiment of the present invention can follow the rule that "some legitimate users will use historical passwords to try to log in", the attack detection process of the embodiment of the present invention can exclude the login failure records generated by the use of historical passwords by legitimate users; therefore, the embodiment of the present invention can reduce the situation where legitimate IP addresses are misjudged as illegal IP addresses, and reduce the misjudgment rate of illegal IP addresses.

[0019] Furthermore, the attack detection result of the embodiment of the present invention is based on the number of types of abnormal password information, rather than the number of failed logins; thus, even if a legitimate user attempts to log in using an abnormal password and the number of failed logins increases, since the number of types of abnormal password information does not exceed the threshold, it is still possible to avoid the situation where a legitimate IP address is misjudged as an illegal IP address. Therefore, the technical means "based on the number of types of abnormal password information" of the embodiment of the present invention can further reduce the situation where a legitimate IP address is misjudged as an illegal IP address. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art are briefly introduced below.

[0021] Figure 1 A schematic diagram of the structure of an attack detection system according to an embodiment of the present invention;

[0022] Figure 2 This is a flow chart of a method for performing attack detection on login request data in step 202 of an embodiment of the present invention;

[0023] Figure 3 A flowchart of the steps of an attack detection method according to an embodiment of the present invention;

[0024] Figure 4 A flowchart of the steps of an attack detection method according to an embodiment of the present invention;

[0025] Figure 5A flowchart of a method for collecting statistics of login request data according to an embodiment of the present invention;

[0026] Figure 6 A data flow chart of an attack detection method according to an embodiment of the present invention;

[0027] Figure 7 A schematic diagram of the structure of an attack detection device according to an embodiment of the present invention;

[0028] Figure 8 The structure block diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0029] The technical solutions in the embodiments of the present invention will be described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0030] The attack detection method of the embodiment of the present invention can be used to detect network attacks related to account login, thereby protecting the security of user accounts and sensitive information.

[0031] The account login scenarios of the present invention may include: email login, social media login, bank login, or corporate office login, etc. It can be understood that the embodiments of the present invention do not limit the specific account login scenarios.

[0032] In the embodiment of the present invention, the network attack types related to account login specifically include: multi-IP blasting attack. Multi-IP blasting attack is a method of bypassing conventional risk control mechanisms to attempt to illegally log into an account. In this attack, the same email account will be attempted to log in by multiple different IP addresses. It can be understood that the embodiment of the present invention does not limit the specific network attack types detected.

[0033] In view of the technical problem that a legal IP address is misjudged as an illegal IP address in the related art, an embodiment of the present invention provides an attack detection method, which specifically includes:

[0034] Receive login request data; the login request data specifically includes: N login request data corresponding to N login processes, one login process generates one login request data, one login request data specifically includes: user account, login password information and login IP; N is a positive integer;

[0035] Attack detection is performed on the login request data based on the matching information between the login password information and the historical password information in any login request data, and the number of types of abnormal password information corresponding to the login password information in N login request data; the historical password information is different from the accurate password information, but has successfully logged into the user account, or the historical password information is login password information that has not successfully logged into the user account, but the number of occurrences or the frequency of occurrence meets the preset frequent conditions; the abnormal password information is different from both the accurate password information and the historical password information.

[0036] The embodiment of the present invention performs attack detection on the login request data according to the matching information between the login password information and the historical password information in any login request data, and the number of types of abnormal password information corresponding to the login password information in N login request data.

[0037] If a legitimate user forgets his password, he may use multiple IP addresses corresponding to multiple devices such as mobile phones, computers, and tablets to try to log in to his account. However, when a legitimate user tries to log in to his account, the login password he uses usually has a certain pattern. For example, some legitimate users will use historical passwords to try to log in.

[0038] In the embodiment of the present invention, if the login password information is the same as the historical password that has been used to successfully log in to the user account, or is consistent with the historical password information that has not been successfully logged in but the number of times or frequency of occurrence meets the preset frequent conditions, the embodiment of the present invention will tend to believe that this may be the operation of a legitimate user, and will not be determined as an illegal login. Since the technical means of the embodiment of the present invention "based on the matching information between the login password information and the historical password information" can follow the rule that "some legitimate users will use historical passwords to try to log in", the attack detection process of the embodiment of the present invention can exclude the login failure records generated by the legitimate user using the historical password; therefore, the embodiment of the present invention can reduce the situation where the legitimate IP address is mistakenly judged as an illegal IP address.

[0039] Furthermore, the attack detection result of the embodiment of the present invention is based on the number of types of abnormal password information, rather than the number of failed logins; thus, even if a legitimate user attempts to log in using an abnormal password and the number of failed logins increases, since the number of types of abnormal password information does not exceed the threshold, it is still possible to avoid the situation where a legitimate IP address is misjudged as an illegal IP address. Therefore, the technical means "based on the number of types of abnormal password information" of the embodiment of the present invention can further reduce the situation where a legitimate IP address is misjudged as an illegal IP address.

[0040] Reference Figure 1, shows a schematic diagram of the structure of an attack detection system according to an embodiment of the present invention, which may specifically include: a client 101 and a server 102. The client 101 and the server 102 may perform data exchange based on a wireless network or a wired network.

[0041] In actual applications, the client 101 may receive login request data input by the user, and send the login request data to the server.

[0042] In an example, the server 102 of the embodiment of the present invention may include: an attack detection server and an application server. The attack detection server may use the attack detection method of the embodiment of the present invention to detect whether a single login request data has a risk, or detect whether N login request data have a risk.

[0043] Wherein, if the one-time login request data or N-time login request data is risk-free, the corresponding login request data may be released. The above release process may allow the corresponding login request data to reach the application server.

[0044] In the case where there is a risk in the N login request data, a preset alarm process can be performed on the corresponding login request data. For example, the preset alarm process can include: blocking login, etc. Among them, blocking login can block the most recent login request data corresponding to the N login request data, and prohibit the most recent login request data from reaching the application server. The above preset alarm process can also save the login IP corresponding to the N login request data to the IP blacklist, so that further access corresponding to the IP in the IP blacklist can be prevented.

[0045] In one example, the login request data of the embodiment of the present invention may follow the New Technology Local Area Network Manager (NTLM) protocol. In this case, the attack detection server may include: a parsing module and a risk detection module. The parsing module may parse the login request data to obtain information such as user account, login password information, and login IP contained in the login request data. The risk detection module may use the attack detection method of the embodiment of the present invention to detect whether there is a risk in one login request data, or detect whether there is a risk in N login request data.

[0046] When the login request data complies with the NTLM protocol, the login password information parsed by the attack detection server may be: a login password hash value. This can prevent servers other than the application server from obtaining the login password string, thereby improving the security of the login password string.

[0047] In other cases, the login password information may be: a login password string. For example, when the attack detection method of the embodiment of the present invention is executed by an application server, the application server may directly use the login password string to perform the processing of the embodiment of the present invention.

[0048] The embodiments of the present invention are described below through specific examples.

[0049] Reference Figure 2 , shows a flowchart of the steps of an attack detection method according to an embodiment of the present invention, the method may specifically include the following steps:

[0050] Step 201, receiving login request data; the login request data specifically includes: N login request data corresponding to N login processes, one login process generates one login request data, one login request data specifically includes: user account, login password information and login IP; N can be a positive integer;

[0051] Step 202: Perform attack detection on the login request data based on the matching information between the login password information and the historical password information in any login request data, and the number of types of abnormal password information corresponding to the login password information in N login request data; the historical password information is different from the accurate password information, but has successfully logged into the user account, or the historical password information is login password information that has not successfully logged into the user account, but the number of occurrences or the frequency of occurrences meet the preset frequent conditions; the abnormal password information is different from both the accurate password information and the historical password information.

[0052] Figure 2 The method embodiment shown can be executed by the server to detect network attacks related to account login, thereby protecting the security of user accounts and sensitive information. Figure 2 The specific execution subject of the illustrated method embodiment is not limited.

[0053] In step 201, the server may receive login request data sent by the client; the login request data specifically includes: N login request data corresponding to N login processes. The login times corresponding to the N login processes may be different. For example, the login time of the i-th login process is earlier than the login time of the (i+1)-th login process, where i and N may be positive integers.

[0054] It should be noted that the N login request data corresponding to the N login processes may be different according to different user accounts. Moreover, for the same user account, the N login request data corresponding to the N login processes may be different according to different time periods. The specific value of N can be determined by those skilled in the art according to actual application requirements, and the embodiment of the present invention does not limit the specific value of N. The embodiment of the present invention can perform attack detection on the N login request data corresponding to the same user account to determine whether it involves a network attack.

[0055] In step 202, the embodiment of the present invention can determine whether the i-th login request data has a risk based on the i-th login request data among the N login request data; or, the embodiment of the present invention can determine whether the N login request data has a risk based on the i-th login request data among the N login request data. The i-th login request data can represent any login request data among the N login request data, i.e., i=1, 2, ..., N. Therefore, the attack detection result of the embodiment of the present invention specifically includes: the attack detection result corresponding to the i-th login request data, or the attack detection result corresponding to the N login request data.

[0056] It should be noted that the attack detection method of the embodiment of the present invention can be applied when the login password information is inaccurate. When the login password information is accurate, the corresponding user can be assumed to be a legitimate user.

[0057] Therefore, after receiving a login request data, the embodiment of the present invention can first determine whether the login password information contained in the login request data is accurate. Alternatively, the login request data of the embodiment of the present invention can include the following information: whether the login password information is accurate. The N login request data of the embodiment of the present invention can correspond to: login request data with inaccurate login password information.

[0058] Reference Figure 3 , showing a flow chart of a method for performing attack detection on login request data in step 202, step 202 may specifically include any of the following steps:

[0059] Step 221: When the matching information between the login password information and the historical password information in any login request data is a successful match, the corresponding attack detection result is no risk; or

[0060] Step 222: If the login password information in the i-th login request data is inaccurate, and the matching information between the login password information in the i-th login request data and the historical password information is a match failure, the login IP contained in the login request data that failed to match is saved to the high-risk IP set. If the login IP in the j-th login request data does not belong to the high-risk IP set, the corresponding attack detection result is no risk; i and j are positive integers not greater than N; or

[0061] Step 223: When the number of types of abnormal password information corresponding to the login password information in the N login request data does not exceed the quantity threshold, the corresponding attack detection result is no risk.

[0062] In an implementation method corresponding to step 221, in the embodiment of the present invention, when the matching information between the login password information and the historical password information in any login request data is a successful match, the attack detection result corresponding to the N login request data is determined to be risk-free. Since the technical means "based on the matching information between the login password information and the historical password information" can follow the rule that "some legitimate users will use historical passwords to try to log in", the attack detection process of the embodiment of the present invention can exclude the login failure records generated by the legitimate users using historical passwords; therefore, the embodiment of the present invention can reduce the situation where the legitimate IP address is misjudged as an illegal IP address.

[0063] Among them, the matching information between the login password information and the historical password information is a successful match, which specifically includes: the login password information is the same as the historical password information, and can follow the rule that "some legitimate users will use historical passwords to try to log in". Specifically, the login password hash value is the same as the historical password hash value, or the login password string is the same as the historical password string. Among them, the login password hash value or the login password string is a specific implementation of the login password information. The historical password hash value or the historical password string is a specific implementation of the historical password information. In other words, the login password information specifically includes: the login password hash value, or the login password string. The historical password information specifically includes: the historical password hash value, or the historical password string.

[0064] The embodiment of the present invention can determine the matching information between the login password information in any login request data and the historical password information based on the historical password information set. Since users have certain memory habits for historical passwords, legitimate users may use historical passwords to attempt to log in. Therefore, the embodiment of the present invention can use the historical password information in the historical password information set to determine the matching information between the login password information in any login request data and the historical password information.

[0065] In practical applications, the above historical password information set specifically includes: a historical hash set for storing historical password hash values, and / or a historical string set for storing historical password strings. The matching information between the login password information and the historical password information in any login request data is a successful match, specifically including: the login password hash value is the same as the historical password hash value, and / or the login password string is the same as the historical password string.

[0066] The above process of determining the matching information between the login password information and the historical password information in any login request data specifically includes: searching in the historical password information set according to the login password information in any login request data; if the search is successful, the matching information between the login password information and the historical password information is a successful match; if the search fails, the matching information between the login password information and the historical password information is a failed match.

[0067] In a specific implementation, the method of the embodiment of the present invention may further include: if the login password information in any login request data is accurate, saving the login password information as historical password information to a historical password information set. In this case, the historical password information set can be used to store historical password information of successful logins to user accounts.

[0068] Alternatively, the method of the embodiment of the present invention may further include: counting the login password information contained in the login request data within a preset time period to obtain the number of occurrences or the frequency of occurrence corresponding to the login password information; and saving the login password information whose number of occurrences or the frequency of occurrences meets the preset frequent condition to the historical password information set. In this case, the historical password information set can be used to store login password information that has not successfully logged into the user account, but whose number of occurrences or the frequency of occurrences within the preset time period meet the preset frequent condition.

[0069] The preset time period can be determined by those skilled in the art according to actual application requirements. For example, the preset time period can be the last X days, or the last Y hours, etc., where X and Y can be positive integers. For example, the user's memory is wrong, resulting in the first character string corresponding to the correct password being mistakenly remembered as the second character string, and the second character string is frequently entered within 7 days; then the embodiment of the present invention can use the second character string as a supplement to the historical password information and save it to the historical password information set. Since the embodiment of the present invention can use the login password information that the user mistakenly remembers and frequently enters in the historical password set to determine the matching information between the login password information and the historical password information in any login request data; therefore, the embodiment of the present invention can exclude the corresponding login failure records in the case where "some legitimate users will use the wrongly remembered password to try to log in"; therefore, the embodiment of the present invention can further reduce the situation where the legitimate IP address is misjudged as an illegal IP address.

[0070] The preset frequent condition may include: the number of occurrences is greater than a first threshold, or the frequency of occurrence is greater than a second threshold, etc. It can be understood that the embodiment of the present invention does not limit the specific preset frequent condition.

[0071] In the implementation method corresponding to step 223, when the number of types of abnormal password information corresponding to the login password information in the N login request data does not exceed the number threshold, the embodiment of the present invention determines the corresponding attack detection result as risk-free. The attack detection result of the embodiment of the present invention is based on the number of types of abnormal password information, not the number of login failures; in this way, even if a legitimate user uses an abnormal password to try to log in and the number of login failures increases, the number of types of abnormal password information does not exceed the number threshold, so it can still avoid the situation where a legitimate IP address is misjudged as an illegal IP address. Therefore, the technical means of "based on the number of types of abnormal password information" in the embodiment of the present invention can further reduce the situation where a legitimate IP address is misjudged as an illegal IP address.

[0072] In practical applications, the embodiment of the present invention can determine the number of types of abnormal password information corresponding to the login password information in the N login request data according to the abnormal password information set. The abnormal password information set can be used to store abnormal password information that is different from both accurate password information and historical password information.

[0073] The embodiment of the present invention can first match the login password information in the N login request data with the abnormal password information in the abnormal password information set, and then record the target abnormal password information that has been successfully matched; then, count the number of types of the target abnormal password information.

[0074] For example, among the login password information in N login request data, the first M pairs of login request data successfully match abnormal password information A, and the last (NM) pairs of login request data successfully match abnormal password information B, then the number of types of abnormal password information corresponding to the login password information in the N login request data is 2. M can be a positive integer.

[0075] In a specific implementation, a matching set can be used to record the target abnormal password information that has been successfully matched; and the login password information in the N login request data can be matched with the abnormal password information in the abnormal password information set in a preset order. If the match is successful, it can be determined whether the successfully matched target abnormal password information appears in the matching set. If not, the successfully matched target abnormal password information can be recorded in the matching set. The preset order can be: the order from the front to the back of the login time, or the preset order can be: the order from the back to the front of the login time. After completing the matching between the login password information in the N login request data and the abnormal password information in the abnormal password information set, the number of target abnormal password information in the matching set can be counted, and the statistical result can be used as the number of types of abnormal password information.

[0076] In the embodiment of the present invention, the construction process of the abnormal password information set specifically includes: in the case where the login password information in any login request data is inaccurate, if the matching information between the login password information in any login request data and the historical password information is a matching failure, then the login password information contained in any login request data is added to the abnormal password information set. In the case where the login password information in any login request data is inaccurate, if the matching information between the login password information in any login request data and the historical password information is a matching failure, it can be explained that the login password information is different from both the accurate password information and the historical password information, and therefore, the login password information can be added to the abnormal password information set.

[0077] In an optional implementation of an embodiment of the present invention, the method may further include: when the number of types of abnormal password information corresponding to the login password information in the N login request data exceeds the number threshold, the attack detection result corresponding to the N login request data is that there is a risk. The number of types of abnormal password information exceeds the number threshold, which may indicate that an illegal user attempts to use multiple types of abnormal passwords to perform a brute force attack on the user account. When the attack detection result corresponding to the N login request data is that there is a risk, an alarm process may be triggered.

[0078] Accordingly, the method of the embodiment of the present invention may further include: when the attack detection result corresponding to the N login request data is a risk, blocking the most recent login request data corresponding to the N login request data, and saving the login IP corresponding to the N login request data to an IP blacklist. Blocking the login may block the most recent login request data corresponding to the N login request data, and prohibit the most recent login request data from reaching the application server. Saving the login IP corresponding to the N login request data to an IP blacklist may prevent further access to the IP in the IP blacklist.

[0079] In the implementation method corresponding to step 222, the embodiment of the present invention first saves the login IP contained in the login request data that failed to match to the high-risk IP set when the login password information in the i-th login request data is inaccurate and the matching information between the login password information in the i-th login request data and the historical password information is a match failure, and then uses the high-risk IP set to judge the login IP in the j-th login request data. Specifically, if the login IP in the j-th login request data does not belong to the high-risk IP set, the attack detection result corresponding to the N-th login request data is determined to be risk-free. Among them, j can be a positive integer greater than i.

[0080] Since the high-risk IPs in the high-risk IP set do not include: IPs that have used historical passwords; thus, the attack detection process of the embodiment of the present invention can exclude login failure records caused by legitimate users using historical passwords; therefore, the embodiment of the present invention can reduce the situation where legitimate IP addresses are misjudged as illegal IP addresses.

[0081] It can be understood that those skilled in the art can adopt one or more of step 221, step 222 and step 223 according to actual application requirements.

[0082] In the case of using multiple ones of step 221 , step 222 and step 223 , the embodiment of the present invention does not limit the execution order of step 221 , step 222 and step 223 .

[0083] In one example, step 221 may be performed first. Specifically, it is determined whether the matching information between the login password information and the historical password information in the i-th login request data is a successful match, and if so, the attack detection result corresponding to the N-th login request data is risk-free.

[0084] If the matching information between the login password information and the historical password information in the i-th login request data is a match failure, step 222 may be executed.

[0085] In step 222, if the login password information in the i-th login request data is inaccurate, and the matching information between the login password information in the i-th login request data and the historical password information is a match failure, the login IP contained in the login request data that failed to match is saved to the high-risk IP set. In addition, it is determined whether the login IP in the j-th login request data belongs to the high-risk IP set, if not, then the attack detection result corresponding to the N-th login request data is risk-free.

[0086] If the login IP in the jth login request data belongs to the high-risk IP set, step 223 can be executed. In step 223, when the number of types of abnormal password information corresponding to the login password information in the N login request data does not exceed the number threshold, the corresponding attack detection result is no risk.

[0087] When step 222 and step 223 are executed successively, the process of performing attack detection on the login request data of an embodiment of the present invention may also include: if the login IP in the j-th login request data belongs to a high-risk IP set, then determining whether the number of types of abnormal password information corresponding to the login password information in the N-times login request data exceeds a quantity threshold, so as to obtain a second judgment result; when the second judgment result is no, the attack detection result corresponding to the N-times login request data is risk-free.

[0088] In summary, the attack detection method of the embodiment of the present invention determines the corresponding attack detection result as risk-free when the matching information between the login password information and the historical password information in any login request data is a successful match. Since the technical means "based on the matching information between the login password information and the historical password information" can follow the rule that "some legitimate users will use historical passwords to try to log in", the attack detection process of the embodiment of the present invention can exclude the login failure records generated by the legitimate users using historical passwords; therefore, the embodiment of the present invention can reduce the situation where the legitimate IP address is misjudged as an illegal IP address.

[0089] Furthermore, in the embodiment of the present invention, when the number of types of abnormal password information corresponding to the login password information in the N login request data does not exceed the quantity threshold, the corresponding attack detection result is determined as risk-free. The attack detection result of the embodiment of the present invention is based on the number of types of abnormal password information, not the number of login failures; in this way, even if a legitimate user attempts to log in using an abnormal password and the number of login failures increases, the number of types of abnormal password information does not exceed the quantity threshold, so the situation where a legitimate IP address is misjudged as an illegal IP address can still be avoided. Therefore, the technical means "based on the number of types of abnormal password information" of the embodiment of the present invention can further reduce the situation where a legitimate IP address is misjudged as an illegal IP address.

[0090] In addition, the high-risk IP set is used to judge the login IP in the j-th login request data. Since the high-risk IP in the high-risk IP set does not include: IPs that have used historical passwords; thus, the attack detection process of the embodiment of the present invention can exclude the login failure records generated by the use of historical passwords by legitimate users; therefore, the embodiment of the present invention can reduce the situation where legitimate IP addresses are mistakenly judged as illegal IP addresses.

[0091] Reference Figure 4, shows a flowchart of the steps of an attack detection method according to an embodiment of the present invention, the method may specifically include the following steps:

[0092] Step 401, receiving login request data; the login request data specifically includes: N login request data corresponding to N login processes, one login process generates one login request data, one login request data includes: user account, login password information and login IP; N is a positive integer;

[0093] Step 402: determine whether the login IP in any login request data belongs to the high-risk IP set to obtain a first determination result; wherein, if the login password information in any login request data is inaccurate, if the matching information between the login password information in any login request data and the historical password information is a match failure, the login IP contained in the login request data that fails to match is saved to the high-risk IP set;

[0094] Step 403: If the first judgment result is no, the attack detection result corresponding to any login request data is no risk;

[0095] Step 404: if the first judgment result is yes, determine whether the number of types of abnormal password information corresponding to the login password information in the N login request data exceeds the number threshold, so as to obtain a second judgment result;

[0096] Step 405: When the second judgment result is no, the attack detection result corresponding to the N login request data is no risk.

[0097] The embodiment of the present invention can pre-construct a high-risk IP set. The high-risk IP set can store high-risk IPs with potential risks. The construction process of the high-risk IP set specifically includes: in the case where the login password information in any login request data is inaccurate, if the matching information between the login password information in any login request data and the historical password information is a matching failure, then the login IP contained in the login request data with the failed matching is saved to the high-risk IP set.

[0098] In practical applications, it can be determined whether the login IP in any login request data included in the N login request data belongs to the high-risk IP set. If not, it can be said that the attack detection result corresponding to any login request data is risk-free. Any login request data can be the i-th login request data included in the N login request data, and the i-th login request data can be the most recent login request data, such as the N-th login request data.

[0099] If the login request data is risk-free, the login request data may be released. The release process may allow the login request data to reach the application server.

[0100] When the first judgment result is yes, it can be further determined whether the number of types of abnormal password information corresponding to the login password information in the N login request data exceeds the quantity threshold. If not, the attack detection result corresponding to the N login request data can be risk-free.

[0101] In the case that the N login request data are risk-free, the most recent login request data (such as the Nth login request data) among the N login request data may be released. The above release process may allow the most recent login request data to reach the application server.

[0102] In an optional embodiment of the present invention, the above method may further include: when the second judgment result is yes, the attack detection result corresponding to the N login request data is that there is a risk.

[0103] Accordingly, the method of the embodiment of the present invention may further include: when the attack detection result corresponding to the N login request data is a risk, blocking the most recent login request data corresponding to the N login request data, and saving the login IP corresponding to the N login request data to an IP blacklist. Blocking the login may block the most recent login request data corresponding to the N login request data, and prohibit the most recent login request data from reaching the application server. Saving the login IP corresponding to the N login request data to an IP blacklist may prevent further access to the IP in the IP blacklist.

[0104] In practical applications, the embodiment of the present invention can determine the number of types of abnormal password information corresponding to the login password information in the N login request data according to the abnormal password information set. The abnormal password information set can be used to store abnormal password information that is different from both accurate password information and historical password information.

[0105] Accordingly, the method of the embodiment of the present invention may further include: in the event that the login password information in any login request data is inaccurate, if the matching information between the login password information in any login request data and the historical password information is a matching failure, then adding the login password information contained in any login request data to an abnormal password information set; based on the abnormal password information set, determining the number of types of abnormal password information corresponding to the login password information in N login request data.

[0106] In summary, the attack detection method of the embodiment of the present invention, when the login IP in any login request data does not belong to the high-risk IP set, will determine the corresponding attack detection result as risk-free. Among them, the construction process of the high-risk IP set specifically includes: when the login password information in any login request data is inaccurate, if the matching information between the login password information and the historical password information in any login request data is a matching failure, then the login IP contained in the login request data with the failed matching is saved to the high-risk IP set. Since the high-risk IP in the high-risk IP set does not include: IPs that have used historical passwords; in this way, the attack detection process of the embodiment of the present invention can exclude login failure records caused by legitimate users using historical passwords; therefore, the embodiment of the present invention can reduce the situation where legitimate IP addresses are misjudged as illegal IP addresses.

[0107] Furthermore, in the embodiment of the present invention, when the number of types of abnormal password information corresponding to the login password information in the N login request data does not exceed the quantity threshold, the corresponding attack detection result is determined as risk-free. The attack detection result of the embodiment of the present invention is based on the number of types of abnormal password information, not the number of login failures; in this way, even if a legitimate user attempts to log in using an abnormal password and the number of login failures increases, the number of types of abnormal password information does not exceed the quantity threshold, so the situation where a legitimate IP address is misjudged as an illegal IP address can still be avoided. Therefore, the technical means "based on the number of types of abnormal password information" of the embodiment of the present invention can further reduce the situation where a legitimate IP address is misjudged as an illegal IP address.

[0108] Reference Figure 5 , shows a flowchart of a method for counting login request data according to an embodiment of the present invention, the method may specifically include the following steps:

[0109] Step 501: Receive current login request data; the current login request data may be the i-th login request data.

[0110] Step 502: extract the user account, login password information, login IP and whether the login password is accurate from the current login request data;

[0111] Step 503: determine whether the login password in the current login request data is correct, if so, execute step 504, otherwise execute step 505;

[0112] Step 504: save the login password information in the current login request data as historical password information to the historical password information set;

[0113] Step 505: determine whether the login password information in the current login request data belongs to the historical password information set. If so, end the statistics. Otherwise, execute step 506.

[0114] Step 506: Save the login IP in the current login request data to the high-risk IP set, and add the login password information contained in the current login request data to the abnormal password information set.

[0115] Figure 4 Statistical processing can be performed on any current login request data, so that when the login password information in the current login request data is inaccurate and different from the historical password information, the login IP in the current login request data is saved to the high-risk IP set, and the login password information included in the current login request data is added to the abnormal password information set. This embodiment can realize the construction of the high-risk IP set and the abnormal password information set.

[0116] Reference Figure 6 , shows a flowchart of the steps of an attack detection method according to an embodiment of the present invention, the method may specifically include the following steps:

[0117] Step 601, receiving login request data; the login request data specifically includes: N login request data corresponding to N login processes, one login process generates one login request data, one login request data includes: user account, login password information and login IP; N is a positive integer;

[0118] Step 602: Perform statistical processing on the user login request data to obtain a high-risk IP set and an abnormal password information set. For details, please refer to Figure 4 .

[0119] Step 603: Check whether the login IP belongs to the high-risk IP set;

[0120] Here, it can be detected whether the login IP included in the current login request data or the i-th login request data belongs to the high-risk IP set. If not, step 604 is executed, otherwise, step 605 is executed;

[0121] Step 604: If the attack detection result corresponding to the current login request data or the i-th login request data is no risk, the request is released;

[0122] Step 605: determine whether the number of types of abnormal password information corresponding to multiple login IPs in the N login request data exceeds the number threshold. If so, execute step 606;

[0123] The N login request data may be: the N login request data with the same user account as the current login request data. The N login request data may include multiple login IPs.

[0124] Step 606: If there is a risk, this login is blocked and multiple login IPs in the N login request data are added to the IP blacklist.

[0125] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0126] Reference Figure 7 , shows a schematic diagram of the structure of an attack detection device according to an embodiment of the present invention, and the attack detection device may specifically include the following modules:

[0127] The receiving module 701 is used to receive login request data; the login request data includes: N login request data corresponding to N login processes, one login process generates one login request data, and one login request data includes: user account, login password information and login IP; N is a positive integer;

[0128] The attack detection module 702 is used to perform attack detection on the login request data based on the matching information between the login password information and the historical password information in any login request data, and the number of types of abnormal password information corresponding to the login password information in N login request data; the historical password information is different from the accurate password information, but has successfully logged into the user account, or the historical password information is the login password information that has not successfully logged into the user account, but the number of occurrences or the frequency of occurrence meets the preset frequent condition; the abnormal password information is different from both the accurate password information and the historical password information.

[0129] In a specific implementation, the attack detection module 702 may include any of the following modules:

[0130] A first attack detection module is used for, when the matching information between the login password information and the historical password information in any login request data is a successful match, the corresponding attack detection result is no risk; or

[0131] The second attack detection module is used to save the login IP contained in the login request data with failed matching to the high-risk IP set if the login password information in the i-th login request data is inaccurate and the matching information between the login password information in the i-th login request data and the historical password information is a matching failure; if the login IP in the j-th login request data does not belong to the high-risk IP set, the corresponding attack detection result is no risk; i and j are positive integers not greater than N; or

[0132] The third attack detection module is used to detect that the corresponding attack detection result is no risk when the number of types of abnormal password information corresponding to the login password information in the N login request data does not exceed the quantity threshold.

[0133] Optionally, the device may further include:

[0134] The matching information determination module is used to search in the historical password information set according to the login password information in any login request data. If the search is successful, the matching information between the login password information and the historical password information is a successful match. If the search fails, the matching information between the login password information and the historical password information is a failed match.

[0135] Optionally, the process of constructing the historical password information set includes:

[0136] If the login password information in any login request data is correct, the login password information is saved as historical password information in the historical password information collection; and / or

[0137] The login password information contained in the login request data within a preset time period is counted to obtain the number of occurrences or the frequency of occurrence corresponding to the login password information; the login password information whose number of occurrences or the frequency of occurrence meets the preset frequent condition is saved in the historical password information set.

[0138] Optionally, the device may further include:

[0139] The third attack detection module is used to detect that the attack detection result corresponding to the N login request data is a risk when the number of types of abnormal password information corresponding to the login password information in the N login request data exceeds a quantity threshold.

[0140] Optionally, the device further comprises:

[0141] The risk processing module is used to block the most recent login request data corresponding to the N login request data when the attack detection result corresponding to the N login request data is a risk, and save the login IP corresponding to the N login request data to the IP blacklist.

[0142] Optionally, the device may further include:

[0143] The abnormal number determination module is used to match the login password information in N login request data with the abnormal password information in the abnormal password information set to obtain a matching result; based on the matching result, record the target abnormal password information that has been successfully matched; and count the number of types of the target abnormal password information to obtain the number of types of abnormal password information corresponding to the login password information in the N login request data.

[0144] Optionally, the device may further include:

[0145] The abnormal set building module is used to add the login password information contained in any login request data to the abnormal password information set if the login password information in any login request data is inaccurate and the matching information between the login password information in any login request data and the historical password information is a matching failure.

[0146] An embodiment of the present invention further provides an electronic device that can implement the functions of the aforementioned storage node or scheduling node or ledger node or management node.

[0147] like Figure 8 As shown, the electronic device may include a processor 1001, a communication interface 1002, a memory 1003 and a communication bus 1004, wherein the processor 1001, the communication interface 1002, and the memory 1003 communicate with each other via the communication bus 1004.

[0148] Memory 1003, used for storing computer programs;

[0149] The processor 1001 is used to execute the program stored in the memory 1003, and implements the following steps:

[0150] Storing the storage object;

[0151] Sending the storage object to a coupled second storage node, so that the second storage node stores and / or forwards the storage object;

[0152] After the storage object is successfully stored, the object information of the storage object is sent to the ledger node, so that the ledger node saves the ledger information of the first storage node; the ledger information includes: the object information stored in the corresponding storage node.

[0153] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0154] The communication interface is used for communication between the above electronic device and other devices.

[0155] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one attack detection device located away from the aforementioned processor.

[0156] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0157] In another embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium stores instructions. When the instructions are executed on a computer, the computer executes the attack detection method described in any one of the above embodiments.

[0158] In another embodiment of the present invention, a computer program product including instructions is provided. When the computer program product is run on a computer, the computer executes the attack detection method described in any one of the above embodiments.

[0159] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium, or a semiconductor medium (e.g., a solid-state hard disk SolidState Disk (SSD)), etc. Examples of optical media may include DVD (Digital Video Disc) and the like.

[0160] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0161] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0162] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. An attack detection method, characterized in that: The method comprises: Receive login request data; the login request data includes: N login request data corresponding to N login processes, one login process generates one login request data, one login request data includes: user account, login password information and login IP; N is a positive integer; Attack detection is performed on the login request data based on the matching information between the login password information and the historical password information in any login request data, and the number of types of abnormal password information corresponding to the login password information in N login request data; the historical password information is different from the accurate password information, but has successfully logged into the user account, or the historical password information is login password information that has not successfully logged into the user account, but the number of occurrences or the frequency of occurrences meets the preset frequent conditions; the abnormal password information is different from both the accurate password information and the historical password information.

2. The method according to claim 1, characterized in that: The performing attack detection on the login request data includes: If the matching information between the login password information and the historical password information in any login request data is a successful match, the corresponding attack detection result is no risk; or If the login password information in the i-th login request data is inaccurate, and the matching information between the login password information in the i-th login request data and the historical password information is a match failure, the login IP contained in the login request data that failed to match is saved to the high-risk IP set. If the login IP in the j-th login request data does not belong to the high-risk IP set, the corresponding attack detection result is no risk; i and j are positive integers not greater than N; or When the number of types of abnormal password information corresponding to the login password information in the N login request data does not exceed the quantity threshold, the corresponding attack detection result is no risk.

3. The method according to claim 1, characterized in that The method further comprises: According to the login password information in any login request data, a search is performed in the historical password information set. If the search is successful, the matching information between the login password information and the historical password information is a successful match. If the search fails, the matching information between the login password information and the historical password information is a failed match.

4. The method according to claim 3, characterized in that The process of constructing the historical password information set includes: If the login password information in any login request data is correct, the login password information is saved as historical password information in the historical password information collection; and / or The login password information contained in the login request data within a preset time period is counted to obtain the number of occurrences or the frequency of occurrence corresponding to the login password information; the login password information whose number of occurrences or the frequency of occurrence meets the preset frequent condition is saved in the historical password information set.

5. The method according to claim 3, characterized in that: The historical password information set includes: a historical hash set for storing historical password hash values, and / or a historical character string set for storing historical password character strings; The matching information between the login password information and the historical password information in any login request data is a successful match, including: The login password hash value is the same as the historical password hash value, and / or the login password string is the same as the historical password string.

6. The method according to claim 1, characterized in that The method further comprises: When the number of types of abnormal password information corresponding to the login password information in the N login request data exceeds the quantity threshold, the attack detection result corresponding to the N login request data is that there is a risk.

7. The method according to claim 6, characterized in that The method further comprises: When the attack detection result corresponding to the N login request data is that there is a risk, the most recent login request data corresponding to the N login request data is blocked, and the login IP corresponding to the N login request data is saved to the IP blacklist.

8. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: Matching the login password information in the N login request data with the abnormal password information in the abnormal password information set to obtain a matching result; According to the matching results, the target abnormal password information that is successfully matched is recorded; The number of types of target abnormal password information is counted to obtain the number of types of abnormal password information corresponding to the login password information in the N login request data.

9. The method according to claim 8, characterized in that The method further comprises: In the case where the login password information in any login request data is inaccurate, if the matching information between the login password information in any login request data and the historical password information is a match failure, the login password information contained in any login request data is added to the abnormal password information set.

10. The method according to any one of claims 1 to 7, characterized in that: The performing attack detection on the login request data further includes: If the login IP in the j-th login request data belongs to the high-risk IP set, then determine whether the number of types of abnormal password information corresponding to the login password information in the N-th login request data exceeds the quantity threshold to obtain a second determination result; When the second judgment result is no, the attack detection result corresponding to the N login request data is no risk.

11. An attack detection device, characterized in that: The device comprises: A receiving module, used to receive login request data; the login request data includes: N login request data corresponding to N login processes, one login process generates one login request data, one login request data includes: user account, login password information and login IP; N is a positive integer; An attack detection module is used to perform attack detection on the login request data based on the matching information between the login password information and the historical password information in any login request data, and the number of types of abnormal password information corresponding to the login password information in N login request data; the historical password information is different from the accurate password information but has successfully logged into the user account, or the historical password information is the login password information that has not successfully logged into the user account but the number of occurrences or the frequency of occurrence meets the preset frequent condition; the abnormal password information is different from both the accurate password information and the historical password information.

12. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, for implementing the method steps described in any one of claims 1 to 10 when executing a program stored in a memory.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

Images