Traffic detection method and device, electronic equipment and storage medium

Abstract

The invention provides a traffic detection method and device, electronic equipment and a storage medium. The method is applied to intrusion detection equipment for performing bypass monitoring on network traffic flowing through switching equipment, and comprises the following steps: if the first password error times of a source IP address in a first time period fall into a preset numerical value interval, marking as a first-level early warning state and synchronizing to firewall equipment; for the source IP address in the first-level early warning state, if the number of second password errors in a second time period falls into a preset numerical value interval, marking the source IP address as a second-level early warning state and synchronizing the second-level early warning state to the firewall equipment; and for the source IP address in the second-level early warning state, if the number of third password errors in a third time period falls into a preset numerical value interval, it is judged that the attack is slow brute force attack, and a signal is sent to the firewall device to enable the firewall device to block network traffic from the source IP address. According to the method, the network security defense capability and accuracy are remarkably improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a flow detection method, device, electronic device and storage medium. Background Art

[0002] Firewall devices are often used as egress gateways, usually with NAT (Network Address Translation) services and network layer security access control services. Next-generation firewalls already have DPI (Deep Packet Inspection) service functions. However, enabling the DPI service function will seriously affect the performance and stability of firewall devices. In addition, for slow brute force cracking, there is still a high false alarm rate when the DPI service function is enabled on firewall devices, which affects the forwarding of normal business traffic. Summary of the invention

[0003] In order to overcome the problems existing in the related art, the present application provides a flow detection method, device, electronic device and storage medium.

[0004] According to a first aspect of an embodiment of the present application, a traffic detection method is provided, the method being applied to an intrusion detection device, the intrusion detection device performing bypass monitoring on network traffic flowing through a switching device, the method comprising:

[0005] Determine the number of first password errors of the source IP address of the network traffic within a first time period, and if the number of first password errors falls within a preset value interval, mark the source IP address as a first-level warning state, and send a first warning signal to the firewall device so that the firewall device marks the source IP address as a first-level warning state;

[0006] For a source IP address in a first-level warning state, determine the number of second password errors of the source IP address within a second time period, and if the number of second password errors falls within a preset numerical range, mark the source IP address as a second-level warning state, and send a second warning signal to the firewall device so that the firewall device marks the source IP address as a second-level warning state;

[0007] For the source IP address in the second-level warning state, determine the number of third password errors of the source IP address within the third time period. If the number of third password errors falls within the preset numerical range, it is determined to be a slow brute force cracking attack, and a slow brute force cracking attack signal is sent to the firewall device to enable the firewall device to block the network traffic from the source IP address.

[0008] According to a second aspect of an embodiment of the present application, a flow detection device is provided, the device being applied to an intrusion detection device, the intrusion detection device performing bypass monitoring on network flow passing through a switching device, the device comprising:

[0009] A first-level warning module is used to determine the number of first password errors of the source IP address of the network traffic within a first time period, and if the number of first password errors falls within a preset value interval, the source IP address is marked as a first-level warning state, and a first warning signal is sent to the firewall device so that the firewall device marks the source IP address as a first-level warning state;

[0010] A secondary warning module is used to determine the number of second password errors of the source IP address in the second time period for the source IP address in the first warning state, and if the number of second password errors falls within a preset value interval, mark the source IP address as the second warning state, and send a second warning signal to the firewall device so that the firewall device marks the source IP address as the second warning state;

[0011] The slow blocking module is used to determine the number of third password errors of the source IP address in the third time period for the source IP address in the second-level warning state. If the number of third password errors falls within a preset numerical range, it is determined to be a slow brute force cracking attack, and a slow brute force cracking attack signal is sent to the firewall device to enable the firewall device to block the network traffic from the source IP address.

[0012] According to a third aspect of an embodiment of the present application, there is provided an electronic device, comprising a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to implement the method steps described above.

[0013] According to a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the method steps described above are implemented.

[0014] The technical solution provided by the embodiments of the present application may have the following beneficial effects:

[0015] In the embodiment of the present application, the linkage detection and defense of business traffic are realized through the linkage between the intrusion detection device and the firewall device, thereby preventing the DPI business function from affecting the performance of the firewall device. The linkage level warning design can also effectively solve the false alarm problem of slow brute force cracking, and can significantly improve the network security defense capability and accuracy without affecting the firewall performance, forming a more complete and intelligent multi-level security architecture.

[0016] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which are incorporated in the specification and constitute a part of this application, illustrate embodiments consistent with the application and, together with the description, serve to explain the principles of the application.

[0018] Figure 1 A flow chart of a flow detection method provided in an embodiment of the present application;

[0019] Figure 2 This is a schematic diagram of the traditional networking topology;

[0020] Figure 3 A schematic diagram of the network topology provided for this application;

[0021] Figure 4 A flow chart for implementing the flow detection method provided in the embodiment of the present application;

[0022] Figure 5 A schematic diagram of a flow detection device provided in an embodiment of the present application;

[0023] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0025] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0026] It should be understood that, although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" or "if" as used herein may be interpreted as "at the time of" or "when...".

[0027] DPI is a security mechanism that detects and controls network traffic passing through a device based on application layer information. DPI uses the identification results provided by the application layer detection engine to perform corresponding business processing on the message. DPI requires a lot of computing resources because it needs to check and analyze the entire content of the data packet, including the decryption and analysis of encrypted traffic. Therefore, the CPU and memory usage rate increases significantly. Usually, the performance of the firewall device will be halved after the DPI business function is enabled.

[0028] Brute Force Attack is an attack method that attempts to crack a password or gain access rights by repeatedly trying all possible password combinations. It is a widely used and effective attack method, especially against weak passwords or systems that do not take adequate defense measures.

[0029] Slow Brute Force Attack is a relatively low-frequency and covert brute force attack method. It bypasses traditional defense mechanisms by extending the cracking time and reducing the frequency, thereby achieving the effect of guessing and obtaining passwords.

[0030] Recently, the new generation of firewalls not only have brute force cracking capabilities (through feature library rule AC matching), but also have slow brute force cracking capabilities (through custom attack time and thresholds). In a normal office production network, some users often forget their account passwords and try to enter different wrong passwords for their accounts many times. In this scenario, the passwords that users try to enter are likely to hit the firewall's slow brute force cracking, resulting in false positives of user IP address blocking, affecting the user's normal business traffic.

[0031] In summary, enabling the DPI service function will reduce the performance of the firewall device, and the firewall device will have a high false alarm rate for slow brute force attacks.

[0032] Next, the embodiments of the present application are described in detail.

[0033] The embodiment of the present application provides a flow detection method, which is applied to an intrusion detection device, and the intrusion detection device performs bypass monitoring on the network flow flowing through the switching device. Figure 1As shown, the flow detection method includes the following steps:

[0034] Step 110: determining the number of first password errors of the source IP address of the network traffic within the first time period, and if the number of first password errors falls within a preset value interval, marking the source IP address as a first-level warning state, and sending a first warning signal to the firewall device so that the firewall device marks the source IP address as a first-level warning state;

[0035] Step 120: for the source IP address in the first-level warning state, determine the number of second password errors of the source IP address in the second time period; if the number of second password errors falls within a preset value interval, mark the source IP address as the second-level warning state, and send a second warning signal to the firewall device so that the firewall device marks the source IP address as the second-level warning state;

[0036] Step 130: for the source IP address in the second-level warning state, determine the third password error number of the source IP address within the third time period; if the third password error number falls within the preset numerical range, it is determined to be a slow brute force cracking attack, and a slow brute force cracking attack signal is sent to the firewall device to enable the firewall device to block the network traffic from the source IP address.

[0037] The traditional network topology is that the firewall device and the switching device are directly connected in series, such as Figure 2 As shown, the attack source passes through the switching device SW1 directly to the firewall device (FireWall, FW) to the attack target. In this network, the firewall device FW needs to enable the DPI service function. In the networking of this application, the firewall device does not need to enable the DPI service function, and the switching device is connected to the intrusion detection system (IDS) device. An intrusion detection device is a security tool used to detect unauthorized access or abnormal activities within the network. It is a hardware or software system that detects potential security threats or attack behaviors by monitoring network traffic.

[0038] Specifically, Figure 3 As shown, in this application, the intrusion detection device IDS and the firewall device FW are reachable through the management port route, and the two can communicate and send information to each other. The intrusion detection device IDS performs traffic mirroring through the switching device SW1 in the networking for bypass monitoring. All traffic flowing through the firewall device FW is first mirrored and copied to the intrusion detection device IDS through the switching device SW1 mirror for full traffic detection of the DPI service. The detection results or alarm signals of the intrusion detection device IDS can be transmitted to the firewall device FW. The firewall device FW performs linkage judgment based on the detection results of the DPI service, and then performs access control on the service traffic or attack, thereby realizing intelligent linkage detection and defense between the intrusion detection device IDS and the firewall device FW.

[0039] By comparing the two networking methods, it can be seen that the traditional networking uses direct series connection of firewalls for detection, defense and interception, which has a higher probability of generating false alarms. The networking of this application hangs an intrusion detection device next to the switching device. During traffic detection, the intrusion detection device first detects and performs multiple linkage warnings with the firewall device. Finally, the firewall device decides whether to intercept the attack vulnerability or virus based on the linkage warning status, which is more accurate than direct firewall interception.

[0040] In this application, the source IP address refers to the attribute information of the network traffic data. Other attribute information may include: data generation time, destination IP, source port number, destination port number, packet length, etc.

[0041] In this application, the first and second warnings are used to represent increasingly strong warning levels. At the time of the first and second warnings, it is still not completely certain whether it is a slow brute force cracking attack. It may be caused by the administrator or the user's own incorrect password input. In order to prevent accidental blocking, this application is truly determined to be a slow brute force cracking attack if and only if the number of password errors for the same source IP address in three consecutive time periods falls within the preset value range.

[0042] As a specific implementation, the cycle length may be preset to T, the first time period may be from 0 to T, the second time period may be from T to 2T, and the third time period may be from 2T to 3T.

[0043] In addition, when the number of password errors in any time period exceeds the maximum value of the preset numerical interval, the present application will determine it as a brute force attack. Specifically, the intrusion detection device cooperates with the firewall device to block the brute force attack through the following steps: if the number of the first password error number, the second password error number, or the third password error number exceeds the maximum value of the preset numerical interval, it is determined to be a brute force attack, and a brute force attack signal is sent to the firewall device so that the firewall device blocks the network traffic from the source IP address.

[0044] In this application, the intrusion detection device and the firewall device will record the state of the source IP address, and the states of the source IP addresses recorded by the two devices are kept synchronized. Specifically, the intrusion detection device determines the state of the source IP address by analysis, then records the state value of the source IP address and sends a corresponding warning signal or blocking signal to the firewall device, so that the firewall device synchronously records the state value of the source IP address, and the firewall device performs access control blocking of network traffic based on the state value of the source IP address.

[0045] As a specific implementation method, the firewall device in this application blocks network traffic from source IP addresses through a blacklist mechanism. A blacklist is a security mechanism that prevents potential threats and unauthorized access by blocking a set of specific IP addresses, domain names, or network entities.

[0046] It is worth mentioning that the status value of the source IP address defaults to zero. When certain conditions are met, the intrusion detection device will modify it to the first-level warning state, the second-level warning state, and the blocking state. The blocking state can be divided into the blocking state caused by brute force attacks and the blocking state caused by slow brute force attacks according to the blocking reason.

[0047] When other conditions are met, the intrusion detection device may release the warning state of the source IP address. Specifically, the release process of the first-level warning state may be as follows: for the source IP address in the first-level warning state, determine the number of second password errors of the source IP address in the second time period, and if the number of second password errors is less than the minimum value of the preset numerical interval, release the first-level warning state of the source IP address, and send a first release signal to the firewall device so that the firewall device releases the first-level warning state of the source IP address.

[0048] It is understandable that, unlike the first-level warning state, the second-level warning state is a more dangerous situation, so its release conditions will be more complicated. As a specific implementation method, the release process of the second-level warning state can be as follows:

[0049] For the source IP address in the second-level warning state, determine the third number of password errors of the source IP address within the third time period. If the third number of password errors is less than the minimum value of the preset numerical interval, continue to maintain the second-level warning state of the source IP address until the number of password errors of the source IP address within a consecutive preset number of cycles is less than the minimum value of the preset numerical interval. The second-level warning state of the source IP address is released, and a second release signal is sent to the firewall device to cause the firewall device to release the second-level warning state of the source IP address.

[0050] In summary, in this application, the intrusion detection device performs bypass monitoring on the network traffic flowing through the switching device.

[0051] Specifically, the intrusion detection device analyzes the number of password errors from the source IP address in three time periods:

[0052] If the number of incorrect passwords of the source IP address within a time period falls within the preset value range, the source IP address will be marked as a level one warning state and the level one warning state will be synchronized to the firewall device; if the number of incorrect passwords of the source IP address within two consecutive time periods falls within the preset value range, the source IP address will be marked as a level two warning state and the level two warning state will be synchronized to the firewall device; if the number of incorrect passwords of the source IP address within three consecutive time periods falls within the preset value range, it will be determined as a slow brute force cracking attack, the source IP address will be marked as a blocking state and the blocking state will be synchronized to the firewall device, and a slow brute force cracking attack signal will be sent to the firewall device to enable the firewall device to block the network traffic from the source IP address.

[0053] The following uses a slow brute force attack as an application scenario and an actual application as an example to illustrate the linkage detection process of the intrusion monitoring device and the firewall device of the present application.

[0054] In this example scenario, the first time period, the second time period, and the third time period are set to 0 to T, T to 2T, and 2T to 3T, respectively, and the preset value interval is set to 1 to 5.

[0055] In this example scenario, the intrusion detection device and the firewall device enable the linkage detection function, and the intrusion detection device enables the full-flow DPI service detection function by default. The intrusion detection device detects and alerts attacks or viruses, and the firewall device performs access control blocking or blacklist blocking on attacks or viruses. Specifically, the intrusion detection device provides the detected slow brute force attack information to the firewall device for intelligent analysis and judgment. The firewall device triggers the automatic generation of a blacklist strategy through the linkage signal to add the attack source IP to the blacklist, thereby blocking and defending against attacks.

[0056] like Figure 4 As shown in the figure, the specific implementation process of this example scenario is as follows:

[0057] Start the timer. If the intrusion detection device detects that the number of password errors is between 1 and 5 times within T seconds, it will send the first warning signal X-1 to the firewall device, and the firewall device will trigger the linkage level 1 warning. If it is more than 5 times, it will be directly judged as a brute force attack, and a brute force attack signal XB will be sent to the firewall, and the firewall will directly block the blacklist. If it is 0 times, the warning status of the linkage detection of the intrusion detection device and the firewall device will be reset to the default state, that is, 0.

[0058] If the intrusion detection device detects that the number of password errors is between 1 and 5 times within the time T to 2T seconds, it will send the second warning signal X-2 to the firewall device, and the firewall device will trigger the linkage level 2 warning. If it is more than 5 times, it will be directly judged as a brute force attack, and a brute force attack signal XB will be sent to the firewall device, and the firewall device will directly block the blacklist. If it is 0 times, the linkage will release the level 1 warning state, and the warning state of the linkage detection of the intrusion detection device and the firewall device will be reset to 0, the timer will be reset, and the statistical time will restart the statistical detection from the first T seconds.

[0059] If in the linkage level 2 warning state, the intrusion detection device detects that the number of password errors is between 1 and 5 within 2T to 3T seconds, it is judged as a slow brute force attack, and a slow brute force attack signal X-3 is sent to the firewall device, which triggers the linkage level 3 warning and automatically blacklists the attack source IP for blocking. If it is greater than 5 times, it is directly judged as a brute force attack, and a brute force attack signal XB is sent to the firewall device, which directly performs blacklist blocking. If it is 0 times, the linkage level 2 warning state will be maintained until the number of password errors of the source IP address in the next N consecutive cycles is 0, then the level 2 warning state is lifted and restored to the level 1 warning state.

[0060] It can be seen from the above technical solutions that the present application provides a solution for detecting network traffic in conjunction with a firewall device and an intrusion detection device. This solution does not require the firewall device to enable the DPI service. The intrusion detection device performs DPI service detection and analysis on the entire traffic. By coordinating detection with the firewall device, it realizes the detection and defense of the service traffic. The linkage warning design can also effectively solve the false alarm problem of slow brute force cracking. At the same time, the process of this linkage detection method is also applicable to other attack vulnerabilities or virus defense, etc. It can significantly improve the network security defense capability and accuracy without affecting the performance of the firewall, forming a more complete and intelligent multi-level security architecture.

[0061] Based on the same inventive concept, the present application also provides a flow detection device, which is applied to an intrusion detection device, and the intrusion detection device performs bypass monitoring on the network flow flowing through the switching device, such as Figure 5 As shown, the device comprises:

[0062] The first level warning module 510 is used to determine the number of first password errors of the source IP address of the network traffic within a first time period, and if the number of first password errors falls within a preset value interval, mark the source IP address as a first level warning state, and send a first warning signal to the firewall device so that the firewall device marks the source IP address as a first level warning state;

[0063] The second-level warning module 520 is used to determine the number of second password errors of the source IP address in the second time period for the source IP address in the first-level warning state, and if the number of second password errors falls within a preset value interval, mark the source IP address as the second-level warning state, and send a second warning signal to the firewall device so that the firewall device marks the source IP address as the second-level warning state;

[0064] The slow blocking module 530 is used to determine the number of third password errors of the source IP address in the third time period for the source IP address in the second-level warning state. If the number of third password errors falls within a preset numerical range, it is determined to be a slow brute force cracking attack, and a slow brute force cracking attack signal is sent to the firewall device to enable the firewall device to block the network traffic from the source IP address.

[0065] As a specific implementation, the device further includes:

[0066] The blocking module is used to determine that it is a brute force attack if the number of wrong first password attempts, the number of wrong second password attempts, or the number of wrong third password attempts exceeds the maximum value of a preset numerical range, and send a brute force attack signal to the firewall device so that the firewall device blocks the network traffic from the source IP address.

[0067] As a specific implementation, the device further includes:

[0068] The first release module is used to determine the number of second password errors of the source IP address in the second time period for the source IP address in the first level warning state. If the number of second password errors is less than the minimum value of the preset numerical range, the first level warning state of the source IP address is released, and a first release signal is sent to the firewall device to enable the firewall device to release the first level warning state of the source IP address.

[0069] As a specific implementation, the device further includes:

[0070] The second release module is used to determine the number of third password errors of the source IP address in a third time period for the source IP address in the second-level warning state. If the number of third password errors is less than the minimum value of a preset numerical interval, the second-level warning state of the source IP address continues to be maintained until the number of password errors of the source IP address in a consecutive preset number of cycles is less than the minimum value of the preset numerical interval, the second-level warning state of the source IP address is released, and a second release signal is sent to the firewall device to cause the firewall device to release the second-level warning state of the source IP address.

[0071] The present application also provides an electronic device, such as Figure 6As shown, it includes a processor 610 and a machine-readable storage medium 620, wherein the machine-readable storage medium 620 stores machine-executable instructions that can be executed by the processor 610, and the processor 610 is prompted by the machine-executable instructions to implement the steps of any of the above-mentioned traffic detection methods.

[0072] The machine-readable storage medium may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk storage. Optionally, the machine-readable storage medium may also be at least one storage device located away from the processor.

[0073] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0074] In another embodiment provided in the present application, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned flow detection methods are implemented.

[0075] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A flow detection method, characterized in that: The method is applied to an intrusion detection device, the intrusion detection device performs bypass monitoring on network traffic flowing through a switching device, and the method comprises: Determine the number of first password errors of the source IP address of the network traffic within a first time period, and if the number of first password errors falls within a preset value interval, mark the source IP address as a first-level warning state, and send a first warning signal to the firewall device so that the firewall device marks the source IP address as a first-level warning state; For a source IP address in a first-level warning state, determine the number of second password errors of the source IP address within a second time period, and if the number of second password errors falls within a preset numerical range, mark the source IP address as a second-level warning state, and send a second warning signal to the firewall device so that the firewall device marks the source IP address as a second-level warning state; For the source IP address in the second-level warning state, determine the number of third password errors of the source IP address within the third time period. If the number of third password errors falls within the preset numerical range, it is determined to be a slow brute force cracking attack, and a slow brute force cracking attack signal is sent to the firewall device to enable the firewall device to block the network traffic from the source IP address.

2. The method according to claim 1, characterized in that The method further comprises: If the number of incorrect first password attempts, the number of incorrect second password attempts, or the number of incorrect third password attempts exceeds the maximum value of a preset numerical range, it is determined to be a brute force attack, and a brute force attack signal is sent to the firewall device so that the firewall device blocks network traffic from the source IP address.

3. The method according to claim 1, characterized in that The method further comprises: For the source IP address in the first-level warning state, determine the number of second password errors of the source IP address within the second time period. If the number of second password errors is less than the minimum value of the preset numerical range, the first-level warning state of the source IP address is released, and a first release signal is sent to the firewall device to enable the firewall device to release the first-level warning state of the source IP address.

4. The method according to claim 1, characterized in that: The method further comprises: For the source IP address in the second-level warning state, determine the third number of password errors of the source IP address within the third time period. If the third number of password errors is less than the minimum value of the preset numerical interval, continue to maintain the second-level warning state of the source IP address until the number of password errors of the source IP address within a consecutive preset number of cycles is less than the minimum value of the preset numerical interval. The second-level warning state of the source IP address is released, and a second release signal is sent to the firewall device to cause the firewall device to release the second-level warning state of the source IP address.

5. A flow detection device, characterized in that: The device is applied to an intrusion detection device, and the intrusion detection device performs bypass monitoring on network traffic flowing through a switching device. The device includes: A first-level warning module is used to determine the number of first password errors of the source IP address of the network traffic within a first time period, and if the number of first password errors falls within a preset value interval, the source IP address is marked as a first-level warning state, and a first warning signal is sent to the firewall device so that the firewall device marks the source IP address as a first-level warning state; A secondary warning module is used to determine the number of second password errors of the source IP address in the second time period for the source IP address in the first warning state, and if the number of second password errors falls within a preset value interval, mark the source IP address as the second warning state, and send a second warning signal to the firewall device so that the firewall device marks the source IP address as the second warning state; The slow blocking module is used to determine the number of third password errors of the source IP address in the third time period for the source IP address in the second-level warning state. If the number of third password errors falls within a preset numerical range, it is determined to be a slow brute force cracking attack, and a slow brute force cracking attack signal is sent to the firewall device to enable the firewall device to block the network traffic from the source IP address.

6. The device according to claim 5, characterized in that The device also includes: The blocking module is used to determine that it is a brute force attack if the number of wrong first password attempts, the number of wrong second password attempts, or the number of wrong third password attempts exceeds the maximum value of a preset numerical range, and send a brute force attack signal to the firewall device so that the firewall device blocks the network traffic from the source IP address.

7. The device according to claim 5, characterized in that The device also includes: The first release module is used to determine the number of second password errors of the source IP address in the second time period for the source IP address in the first level warning state. If the number of second password errors is less than the minimum value of the preset numerical range, the first level warning state of the source IP address is released, and a first release signal is sent to the firewall device to enable the firewall device to release the first level warning state of the source IP address.

8. The device according to claim 5, characterized in that The device also includes: The second release module is used to determine the number of third password errors of the source IP address in a third time period for the source IP address in the second-level warning state. If the number of third password errors is less than the minimum value of a preset numerical interval, the second-level warning state of the source IP address continues to be maintained until the number of password errors of the source IP address in a consecutive preset number of cycles is less than the minimum value of the preset numerical interval, the second-level warning state of the source IP address is released, and a second release signal is sent to the firewall device to cause the firewall device to release the second-level warning state of the source IP address.

9. An electronic device, characterized in that: The method comprises a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to implement the method steps described in any one of claims 1 to 4.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps of any one of claims 1 to 4 are implemented.

Images