Anti-brute force cracking method and device based on HTTP proxy and storage medium

Abstract

The invention discloses a brute force cracking prevention method based on an HTTP proxy. The method comprises the following steps: acquiring an HTTP request message; analyzing the HTTP request message to obtain a source IP address, an access URL and all parameters of the HTTP request message; when it is detected that a preset interception keyword exists in the parameters of the HTTP request message, it is regarded as a hit interception rule; when the HTTP request message hitting the interception rule is detected, recording the HTTP request message and the recording time through redis; when it is detected that the redis recording times within the preset time range are greater than or equal to a preset interception threshold value, intercepting the HTTP request message; and when it is detected that the number of interception times in the preset time range is smaller than a preset interception threshold value, releasing the HTTP request message.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an anti-brute force cracking method, device and storage medium based on HTTP proxy. Background Art

[0002] In today's digital age, network security issues are becoming increasingly prominent. As a common network technology, HTTP proxy plays an important role in improving network access efficiency and realizing certain specific functions. However, at the same time, HTTP proxy is also facing the threat of brute force attacks. Brute force attacks are an attack method that attempts to gain system access rights by trying a large number of possible username and password combinations. This type of attack not only threatens the information security of individual users, but may also cause serious damage to the network systems of enterprises and organizations, leading to data leakage, business interruption and other problems.

[0003] With the continuous development of network technology, the means of attackers are becoming more diverse and complex. Traditional security measures may have certain limitations when facing brute force attacks, so an anti-brute force method based on HTTP proxy is needed to enhance network security. Summary of the invention

[0004] The main purpose of this application is to provide an anti-brute force cracking method, device and storage medium based on HTTP proxy, aiming to solve the problems mentioned in the background technology.

[0005] The present application provides an anti-brute force cracking method based on HTTP proxy, the method comprising: Get the HTTP request message; Parsing the HTTP request message to obtain the source IP address, access URL and all parameters of the HTTP request message; When the preset interception keyword is detected in the parameters of the HTTP request message, it is considered to have hit the interception rule; When an HTTP request message that hits the interception rule is detected, the HTTP request message and the recording time are recorded through redis; When it is detected that the number of redis records within the preset time range is greater than or equal to the preset interception threshold, the HTTP request message is intercepted; When it is detected that the number of interceptions within the preset time range is less than the preset interception threshold, the HTTP request message is released.

[0006] Furthermore, the method further comprises: When the source IP address of an HTTP request message is detected to be a preset interception IP, it is considered to have hit the interception rule.

[0007] Furthermore, the method further comprises: When it is detected that the access URL of the HTTP request message is a pre-set interception URL, it is considered to have hit the interception rule.

[0008] Further, the method further comprises: when it is detected that the access URL of the HTTP request message is a preset interception URL, it is regarded as hitting the interception rule; when it is detected that the access URL of the HTTP request message is a preset interception URL, it is regarded as hitting the interception rule; When the same HTTP request message is detected to hit multiple interception rules, the number of times corresponding to the number of types of interception rules hit will be recorded.

[0009] Furthermore, after “when it is detected that the number of redis records within a preset time range is greater than or equal to a preset interception threshold”, it also includes: Warnings are sent via text message and / or email.

[0010] Furthermore, the preset interception keyword, the preset time range and the preset interception threshold are all stored in the HTTP proxy server, and also include an interception rule configuration method, which specifically includes: Before starting the HTTP proxy server, set the preset interception keyword, preset time range, and preset interception threshold.

[0011] Furthermore, the invention also includes a method for preventing misjudgment, including: When an HTTP request message that hits the interception rule is detected, the most recently recorded HTTP request message is queried. If the two HTTP request messages come from the same source IP address and the previous HTTP request message is not marked, the recorded previous HTTP request message is marked but the subsequent HTTP request message is not recorded.

[0012] Further, when it is detected that at least two HTTP request messages from different source IP addresses within a preset time range hit the same preset interception keyword, the HTTP request message is intercepted.

[0013] The present invention also provides an anti-brute force cracking device based on HTTP proxy, the device comprising: The acquisition module is used to obtain HTTP request messages; A parsing module, used for parsing the HTTP request message to obtain the source IP address, access URL and all parameters of the HTTP request message; A keyword recognition module is used to detect whether there is a preset interception keyword in the parameters of the HTTP request message. If the preset interception keyword is detected in the parameters of the HTTP request message, it is considered to hit the interception rule; The recording module is used to record the HTTP request message and the recording time through redis when an HTTP request message that hits the interception rule is detected; The judgment module is used to intercept the HTTP request message when it is detected that the number of redis records within the preset time range is greater than or equal to the preset interception threshold. If it is detected that the number of interceptions within the preset time range is less than the preset interception threshold, the HTTP request message is released.

[0014] The present invention also provides a storage medium, including a stored program, which controls the device where the computer-readable storage medium is located to execute the aforementioned HTTP proxy-based anti-brute force cracking method when the program is running.

[0015] The invention configures interception rules and then starts HTTP proxy service. When an HTTP request arrives at the proxy server, the HTTP request message is parsed to identify the keywords to be intercepted. The HTTP message matches the interception standard. Each HTTP message information is recorded in redis according to the interception time. The interception is performed when the number of times the interception rule is hit exceeds a range within the specified time. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0017] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0018] Figure 1 It is a flowchart of the steps of an anti-brute force cracking method based on HTTP proxy according to an embodiment of the present invention.

[0019] Figure 2 It is a modular structure diagram of an anti-brute force cracking device based on HTTP proxy according to an embodiment of the present invention.

[0020] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0021] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work belong to the scope of protection of the present invention.

[0022] See also Figure 1-2 , the present application provides an anti-brute force cracking method based on HTTP proxy, the method comprising: S10: The HTTP request message is obtained.

[0023] S20: Parse the HTTP request message to obtain the source IP address, access URL and all parameters of the HTTP request message.

[0024] S30: When it is detected that a preset interception keyword exists in the parameters of the HTTP request message, it is regarded as hitting the interception rule.

[0025] S40: When an HTTP request message that hits the interception rule is detected, the HTTP request message and the recording time are recorded through redis.

[0026] S51: When it is detected that the number of redis records within a preset time range is greater than or equal to a preset interception threshold, the HTTP request message is intercepted.

[0027] S52: When it is detected that the number of interceptions within the preset time range is less than the preset interception threshold, the HTTP request message is released.

[0028] In a specific embodiment of the present invention, the method further comprises: When the source IP address of an HTTP request message is detected to be a preset interception IP, it is considered to have hit the interception rule.

[0029] In a specific embodiment of the present invention, the method further comprises: When it is detected that the access URL of the HTTP request message is a pre-set interception URL, it is considered to have hit the interception rule.

[0030] In a specific embodiment of the present invention, the method further comprises: when it is detected that the access URL of the HTTP request message is a preset interception URL, it is regarded as hitting the interception rule; when it is detected that the access URL of the HTTP request message is a preset interception URL, it is regarded as hitting the interception rule; When the same HTTP request message is detected to hit multiple interception rules, the number of times corresponding to the number of types of interception rules hit will be recorded.

[0031] In a specific implementation of the present invention, the step of "when it is detected that the number of redis records within a preset time range is greater than or equal to a preset interception threshold" further includes: issuing a warning via SMS and / or email.

[0032] In this embodiment, a warning is sent to a preset mobile phone number or mailbox via text message and / or email to remind the user.

[0033] In a specific implementation of the present invention, the preset interception keyword, the preset time range and the preset interception threshold are all stored in the HTTP proxy server, and also includes an interception rule configuration method, which specifically includes: Before starting the HTTP proxy server, set the preset interception keyword, preset time range, and preset interception threshold.

[0034] In the present invention, the user can configure the interception rules through the password rules, and then start the HTTP proxy service. When the HTTP request arrives at the proxy server, the HTTP protocol is parsed, the keywords to be intercepted are identified, the number and time of HTTP requests are recorded, and the interception is performed when the number of intercepted requests exceeds the range within the specified time, and the interception log is recorded.

[0035] In a specific embodiment of the present invention, a method for preventing misjudgment is also included, including: When an HTTP request message that hits the interception rule is detected, the most recently recorded HTTP request message is queried. If the two HTTP request messages come from the same source IP address and the previous HTTP request message is not marked, the recorded previous HTTP request message is marked but the subsequent HTTP request message is not recorded.

[0036] In reality, it is common for normal users to make multiple login attempts due to reasons such as forgetting passwords. They may enter incorrect passwords multiple times in a short period of time, but this is not a malicious attack. When an HTTP request message that hits the interception rule is detected, if it is found that this HTTP request message and the previous HTTP request message recorded come from the same source IP address, it is considered as multiple login attempts by normal users due to reasons such as forgetting passwords, and the most recent record is reduced. However, in order to avoid multiple attempts using the same IP, the previous HTTP request message recorded is marked to avoid the situation where subsequent multiple HTTP request messages that hit the interception rule are not recorded.

[0037] In addition, on this basis, you can also add monitoring of the source IP address (i.e. setting a pre-set interception IP). If the same source IP address does not belong to the pre-set interception IP, you can continue to implement the aforementioned method to prevent misjudgment; if the same source IP address belongs to the pre-set interception IP, all HTTP request messages will still be regarded as hitting the interception rule and the number of times will be recorded.

[0038] In a specific implementation of the present invention, when it is detected that at least two HTTP request messages originating from different source IP addresses within a preset time range hit the same preset interception keyword, the HTTP request message is intercepted.

[0039] In this embodiment, if at least two HTTP request messages from different source IP addresses hit the same preset interception keyword, it should be considered that there are repeated requests initiated by a dynamic IP, and once found, the HTTP request message is directly intercepted.

[0040] The present invention also provides an anti-brute force cracking device 100 based on HTTP proxy, the device comprising: The acquisition module 10 is used to acquire the HTTP request message; The parsing module 20 is used to parse the HTTP request message to obtain the source IP address, the access URL and all parameters of the HTTP request message; The keyword recognition module 30 is used to detect whether there is a preset interception keyword in the parameters of the HTTP request message. If the preset interception keyword is detected in the parameters of the HTTP request message, it is regarded as hitting the interception rule; The recording module 40 is used to record the HTTP request message and the recording time through redis when an HTTP request message that hits the interception rule is detected; The judgment module 50 is used to intercept the HTTP request message when it is detected that the number of redis records within the preset time range is greater than or equal to the preset interception threshold. If it is detected that the number of interceptions within the preset time range is less than the preset interception threshold, the HTTP request message is released.

[0041] The present invention also provides a storage medium, which includes a stored program, wherein when the program is running, the device where the computer-readable storage medium is located is controlled to execute the above-mentioned HTTP proxy-based anti-brute force cracking method.

[0042] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent processing scope of the present application.

Claims

1. A method for preventing brute force cracking based on HTTP proxy, characterized in that: The method comprises: Get the HTTP request message; Parsing the HTTP request message to obtain the source IP address, access URL and all parameters of the HTTP request message; When the preset interception keyword is detected in the parameters of the HTTP request message, it is considered to have hit the interception rule; When an HTTP request message that hits the interception rule is detected, the HTTP request message and the recording time are recorded through redis; When it is detected that the number of redis records within the preset time range is greater than or equal to the preset interception threshold, the HTTP request message is intercepted; When it is detected that the number of interceptions within the preset time range is less than the preset interception threshold, the HTTP request message is released.

2. The HTTP proxy-based anti-brute force cracking method according to claim 1, characterized in that: The method further comprises: When the source IP address of an HTTP request message is detected as a pre-set interception IP, it is considered to have hit the interception rule.

3. The HTTP proxy-based anti-brute force cracking method according to claim 1, characterized in that: The method further comprises: When it is detected that the access URL of the HTTP request message is a pre-set interception URL, it is considered to have hit the interception rule.

4. The HTTP proxy-based anti-brute force cracking method according to claim 1, characterized in that: The method further comprises: when it is detected that the access URL of the HTTP request message is a preset interception URL, it is regarded as hitting the interception rule; when it is detected that the access URL of the HTTP request message is a preset interception URL, it is regarded as hitting the interception rule; When the same HTTP request message is detected to hit multiple interception rules, the number of times corresponding to the number of types of interception rules hit will be recorded.

5. The HTTP proxy-based anti-brute force cracking method according to claim 1, characterized in that: After "when it is detected that the number of redis records within a preset time range is greater than or equal to a preset interception threshold", it also includes: Warnings are sent via text message and / or email.

6. The HTTP proxy-based anti-brute force cracking method according to claim 1, characterized in that: The preset interception keyword, preset time range and preset interception threshold are all stored in the HTTP proxy server, and also include an interception rule configuration method, which specifically includes: Before starting the HTTP proxy server, set the preset interception keyword, preset time range, and preset interception threshold.

7. The HTTP proxy-based anti-brute force cracking method according to claim 1, characterized in that: It also includes methods to prevent false positives, including: When an HTTP request message that hits the interception rule is detected, the most recently recorded HTTP request message is queried. If the two HTTP request messages come from the same source IP address and the previous HTTP request message is not marked, the recorded previous HTTP request message is marked but the subsequent HTTP request message is not recorded.

8. The HTTP proxy-based anti-brute force cracking method according to claim 1, characterized in that: When it is detected that at least two HTTP request messages from different source IP addresses within a preset time range hit the same preset interception keyword, the HTTP request message is intercepted.

9. An anti-brute force cracking device based on HTTP proxy, characterized in that: The device comprises: The acquisition module is used to obtain HTTP request messages; A parsing module, used for parsing the HTTP request message to obtain the source IP address, access URL and all parameters of the HTTP request message; A keyword recognition module is used to detect whether there is a preset interception keyword in the parameters of the HTTP request message. If the preset interception keyword is detected in the parameters of the HTTP request message, it is considered to hit the interception rule; The recording module is used to record the HTTP request message and the recording time through redis when an HTTP request message that hits the interception rule is detected; The judgment module is used to intercept the HTTP request message when it is detected that the number of redis records within the preset time range is greater than or equal to the preset interception threshold. If it is detected that the number of interceptions within the preset time range is less than the preset interception threshold, the HTTP request message is released.

10. A storage medium, characterized in that: It includes a stored program, which controls the device where the computer-readable storage medium is located to execute the HTTP proxy-based anti-brute force cracking method according to any one of claims 1 to 8 when the program is running.

Images