Determination method and device of blasting attack risk, storage medium and electronic equipment

Abstract

The invention discloses a blasting attack risk determination method and device, a storage medium and electronic equipment, the method is applied to the field of information security, and the method comprises the following steps: when it is detected that a terminal has blasting attack behavior information for first login information of a first service system, determining a blasting attack risk; updating the first password set according to the login password in the first login information; obtaining a second password set of the target service system, and matching the second password set with the updated first password set to obtain a first matching result of the second password set; and according to the first matching result of the second password set, judging whether the login password in the second password set has a blasting attack risk or not. Through application of the method and the device, the problem of relatively low detection accuracy caused by incapability of fully evaluating all possible blasting passwords due to incomplete coverage of a weak password library when detecting whether the terminal equipment has a potential password blasting attack risk in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of information security, and in particular, to a method, device, storage medium and electronic device for determining the risk of a blasting attack. Background Art

[0002] Password cracking is a common attack method used by attackers to obtain passwords by exploiting vulnerabilities or brute force methods. Password cracking is one of the biggest security risks in all network-based applications. User passwords are the easiest system objects to be cracked by brute force. Once a password is cracked by brute force, the attacker can obtain system permissions and even become a system administrator.

[0003] At present, most existing defense measures only detect the attack effect of brute force cracking, and then reduce the efficiency of brute force cracking by storing passwords in key files or limiting the number of consecutive attempts. From the perspective of policy implementation, improving the complexity and length of passwords is an effective means to increase the difficulty of brute force cracking attacks. However, the current password complexity and length settings are difficult to achieve accurate defense effects. For example, if the attacker's attempt method is to try according to a specific dictionary file, and the password complexity and length settings are not targeted at this method, the attacker can use the dictionary file to decipher the password. In this case, the password complexity and length settings only weaken the brute force cracking attack to a certain extent. In addition, the existing password cracking risk assessment methods mainly assess the security risk of passwords by setting password complexity and length, but cannot accurately assess the risk of most passwords being cracked by brute force. For example, within an enterprise, the complexity and length of passwords can be assessed by the password policy set by the enterprise or department. However, if the enterprise or department does not set a password policy, the password complexity and length assessment is difficult to accurately reflect the risk of passwords. In addition, even if users follow the password policy settings of the enterprise or department, attackers may still attempt to attack through dictionary files, brute force cracking software, automated tools, etc. Therefore, it is impossible to accurately assess the risk of brute force cracking by simply judging whether the password complies with the password policy.

[0004] Regarding the problem of low detection accuracy when detecting whether a terminal device has a potential password brute force attack risk in related technologies, due to the incomplete coverage of the weak password library, it is impossible to fully evaluate all possible brute force passwords. No effective solution has been proposed so far. Summary of the invention

[0005] The main purpose of the present application is to provide a method, device, storage medium and electronic device for determining the risk of a brute force attack, so as to solve the problem in the related art that when detecting whether a terminal device has a potential risk of a password brute force attack, the detection accuracy is low due to the incomplete coverage of the weak password library and the inability to fully evaluate all possible brute force passwords.

[0006] To achieve the above-mentioned purpose, according to one aspect of the present application, a method for determining a brute force attack risk is provided, the method comprising: in a case where it is detected that a terminal has brute force attack behavior information for first login information of a first business system, updating a first password set according to the login password in the first login information, wherein the first password set includes login passwords that have been historically subjected to brute force attacks; obtaining a second password set of a target business system, matching the second password set with the updated first password set to obtain a first matching result of the second password set, wherein the target business system is the second business system; or, the target business system is the first business system, and the password set of the first business system includes passwords updated from the login passwords in the first login information; judging whether the login passwords in the second password set have a brute force attack risk according to the first matching result of the second password set.

[0007] Furthermore, the method further includes: comparing the first login information with target feature information, and if the comparison result is that the first login information matches the target feature information, determining that the first login information contains blasting attack behavior information.

[0008] Furthermore, the first login information also includes a first login IP. When the comparison result is that the first login information meets the target characteristic information, the method also includes: determining that the first login IP is an abnormal IP, and receiving a third login request initiated by the abnormal IP, responding to the third login request, and returning authentication failure information, wherein the third login request at least includes: a third login password; updating the first password set based on the third login password to obtain an updated first password set; determining the association relationship between the login passwords in the updated first password set and the target information, wherein the target information includes at least one of the following: attribute information of the login user, a preset weak password, and preset characters; expanding the login passwords in the updated first password set based on the association relationship, and using the expanded first password set as the first password set.

[0009] Further, the first login information is compared with the target characteristic information, including: when the similarity between the login password in the first login information and the preset login password of the terminal is less than a second preset value, determining that the comparison result is that the first login information meets the target characteristic information; or, when the similarity between the login password in the first login information and the third password set of other terminals is greater than a third preset value, determining that the comparison result is that the first login information meets the target characteristic information, wherein the third password set is a password set that has a risk of brute force attack; or, when the number of authentication failure requests initiated by the first login IP to which the first login information belongs is greater than a preset number, and the number of times the first login IP logs into the first business system within a first preset time period is greater than a fourth preset value, determining that the comparison result is that the first login information meets the target characteristic information; or, when the number of login requests initiated by the first login IP within a second preset time period is greater than a fifth preset value, determining that the comparison result is that the first login information meets the target characteristic information.

[0010] Furthermore, obtaining a second password set for the target business system includes: obtaining a second login password for each terminal in at least one terminal for logging into the target business system and a second login user name for each terminal; determining a password verification scheme for each terminal in the at least one terminal for logging into the target business system; and generating the second password set based on the second login password for each terminal in the at least one terminal, the second login user name for each terminal, and the password verification scheme.

[0011] Furthermore, the password verification scheme includes at least one of the following: a first verification method, a second verification method, and a third verification method. The first verification method is a method of directly verifying based on the login password, the second verification method is a method of verifying after encrypting the login password, and the third verification method is a verification method other than the first verification method and the second verification method.

[0012] Further, the second password set is matched with the first password set to obtain a first matching result of the second password set, including: when the password verification scheme corresponding to the second password set is the first verification method, the second login password in the second password set is matched with the first login password in the updated first password set to obtain the first matching result; when the password verification scheme is the second verification method, the second login password is encrypted and the encrypted second login password is matched with the first login password to obtain the first matching result; or the first login password is decrypted and the second login password is matched with the decrypted first login password to obtain the first matching result; when the password verification scheme is the third verification method, a simulated login request is sent to the target business system, and the first matching result is determined according to whether the response result of the simulated login request returned by the target business system indicates that the login is successful, wherein the simulated login request includes: the second login password and the corresponding login user name.

[0013] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a device for determining a brute force attack risk is provided, the device comprising: a first updating unit, for updating a first password set according to a login password in the first login information of a first business system, when detecting that a terminal has brute force attack behavior information for the first login information of the first business system, wherein the first password set includes login passwords that have been historically subjected to brute force attacks; a matching unit, for obtaining a second password set of a target business system, matching the second password set with the updated first password set to obtain a first matching result of the second password set, wherein the target business system is the second business system; or the target business system is the first business system, and the password set of the first business system includes passwords updated from the login passwords in the first login information; a judging unit, for judging whether the login passwords in the second password set have a brute force attack risk according to the first matching result of the second password set.

[0014] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a computer program product is provided, including a computer program, which, when executed by a processor, implements any of the above-mentioned methods for determining the risk of a blasting attack, and which, when executed by a processor, implements the steps of the method for determining the risk of a blasting attack described in each embodiment of the present application.

[0015] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes stored computer instructions, wherein when the computer instructions are executed by a processor, any one of the above-mentioned methods for determining the risk of a blasting attack is implemented.

[0016] In order to achieve the above-mentioned purpose, according to one aspect of the present application, an electronic device is provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement any of the above-mentioned methods for determining the risk of a blasting attack.

[0017] The embodiments of the present application provide a method, device, storage medium and electronic device for determining the risk of a brute force attack. When it is detected that a terminal has brute force attack behavior information for first login information of a first business system, a first password set is updated according to the first login password in the first login information, wherein the first password set includes login passwords that have been subjected to brute force attacks in the past. In this way, more first password sets that are close to the brute force behavior can be captured, and a real-time updated and more realistic brute force attack password library can be constructed. Moreover, by matching the first password set with the second password set of the target business system, the security of the login password of the target system can be evaluated in real time, overcoming the lag and one-sidedness of traditional evaluation methods, identifying login passwords that have been mastered by attackers or are at risk of being cracked by brute force, thereby providing more real-time and comprehensive feedback on the password security status, and then taking protective measures in advance to reduce the possibility of successful brute force attacks, thereby achieving the effect of significantly improving the overall security and protection level of the enterprise system. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0019] Figure 1 is a flow chart of a method for determining blasting attack risk provided in Example 1 of the present application;

[0020] Figure 2 is a schematic diagram of an optional method for determining blasting attack risk provided in Embodiment 1 of the present application;

[0021] Figure 3 is a schematic diagram of a device for determining blasting attack risk provided in Embodiment 2 of the present application;

[0022] Figure 4 It is a schematic diagram of an electronic device for determining the risk of blasting attack provided in Embodiment 5 of the present application. DETAILED DESCRIPTION

[0023] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0024] It should be noted that the user information (including but not limited to user device information, user personal information, collected data, used data, generated data, processed data, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, collected information, used information, generated information, processed information, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with the relevant laws, regulations and standards of relevant countries and regions, necessary confidentiality measures are taken, and public order and good morals are not violated, and corresponding operation portals are provided for users to choose to authorize or refuse. For example, an interface is set between this system and relevant users or organizations. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0025] It should be noted that this application provides users with corresponding operation entrances for them to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered.

[0026] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Embodiment 1

[0029] The present invention is described below in conjunction with preferred implementation steps. Figure 1 1 is a flow chart of a method for determining the risk of a blasting attack according to the first embodiment of the present application, and the method is deployed on at least one terminal of a business system. Figure 1 As shown, the method comprises the following steps:

[0030] Step S101, when it is detected that a terminal has brute force attack behavior information on first login information of a first business system, a first password set is updated according to the login password in the first login information, wherein the first password set includes login passwords that have been brute force attacked in the past.

[0031] The execution subject of the method for determining the blasting attack risk provided in the first embodiment of the present application is a protection system. The protection system can be deployed on at least one terminal in different types of business systems. The structure of the protection system can be as follows: Figure 2 As shown in the figure, it includes three modules: brute force password capture module, login password collection module, and brute force attack risk assessment module. The brute force password capture module is responsible for monitoring and analyzing the login requests of the system or application. When a brute force attack is detected, it will capture and collect all the password information attempted by the attacker. The brute force password capture module uses pseudo login processing, that is, it still allows the attack request to pass when the authentication fails, so as to continuously collect password attempt data for building a real brute force attack password library.

[0032] The login password collection module is responsible for comprehensively collecting password information actually used in the system or application, including plain text passwords, passwords encrypted by known algorithms, and unknown password types collected by simulating logins. The login password collection module ensures that the protection system can obtain all passwords to be verified, providing basic data for subsequent brute force attack risk assessment.

[0033] The brute force attack risk assessment module is responsible for comparing and analyzing the brute force attack password set (i.e., the first password set) collected by the brute force password capture module with all the passwords to be verified of the target business system collected by the login password collection module (i.e., the second password set). Through the password verification scheme, it is possible to detect whether there is a match between the second password set and the first password set, thereby assessing whether there is a risk of the login password of the target business system being cracked by brute force. If a match is detected, the protection system will notify the user and recommend taking appropriate security measures.

[0034] Through the collaborative work of the above three modules, we can continuously improve our understanding of brute force attacks, timely evaluate the security of passwords to be verified, and respond promptly when potential risks are discovered, thereby improving our ability to combat brute force attacks. At the same time, it also provides well-founded analysis results for security maintenance and the formulation of password policies.

[0035] In the first embodiment, when the target terminal (which may also be an electronic device such as a protected business system, terminal, device or application of different types, which is not specifically limited in the first embodiment) receives a login request, the protection system will start the authentication process to verify the login information in the login request. If the password in the login request does not match the correct password stored in the system, the authentication will fail, and this failed login request is called the first login request.

[0036] After the first login request fails to authenticate, the brute force password capture module will collect the login information of the first login request, where the login information includes but is not limited to: login IP, login username, login password and other information. The login IP is the source IP address that initiates the login request, which helps to identify the location of the brute force attacker. The login username refers to the username used in the login request to analyze the username list or strategy that the brute force attacker may use. The login password refers to the login password of the first login request that failed to authenticate. Although the first login request fails to authenticate, the password attempted in the failed authentication request will be recorded to update the first password set.

[0037] The first password set is constructed based on at least weak passwords and login passwords that have been subjected to brute force attacks in the past. Exemplarily, after the target terminal receives multiple login requests and determines that these login requests have brute force attacks, the protection system will construct a first password set based on the login passwords in these first login information, that is, the passwords used in all failed authentication attempts. The first password set is a set of all passwords actually tried by the attacker during the brute force process, which can also be called a brute force password set, including but not limited to common weak passwords, complex passwords, and passwords generated based on user name variants.

[0038] It should be noted that, unlike traditional security strategies, this application does not immediately block or ban brute force attackers after detecting that a login request has failed to authenticate. Instead, it treats these failed login requests as part of a potential brute force attack and performs detailed analysis and processing on them to capture as much brute force password information as possible.

[0039] Through this process, the brute force password capture module can not only detect the initial signs of brute force cracking attacks, but also collect a large amount of brute force password attempt information without directly blocking the attacker, which is conducive to analyzing the behavior patterns of brute force attackers and building a more comprehensive brute force password collection to more effectively combat future brute force cracking attacks, further achieving the technical effect of improving the overall security of the system.

[0040] By constructing the first password set, when a brute force attack against the first business system is detected, not only can effective defense be carried out, but also useful brute force login passwords can be collected to build a dynamic and more comprehensive brute force password set, thereby improving the system's ability to identify and protect against brute force attacks.

[0041] Step S102: Acquire a second password set of the target business system, match the second password set with the updated first password set, and obtain a first matching result of the second password set.

[0042] Here, the target business system is the second business system; or, the target business system is the first business system, and the password set of the first business system includes the password updated from the login password in the first login information.

[0043] In the first embodiment, the login password collection module collects the password actually used by any terminal in at least one terminal to log in to the target business system, that is, to form the above-mentioned second password set. In addition, the second password set may also include the login password used by the application of any terminal in at least one terminal, the login password used by different types of business systems (for example, the first business system, the second business system, etc.), and the password obtained after updating the login password in the above-mentioned first login information. The login password collection module adopts different collection strategies according to different password types (plain text password, known algorithm encrypted password, unknown password type). For example, for plain text passwords, the login password collection module directly reads the plain text in the configuration file or database.

[0044] After obtaining the second password set, the brute force attack risk assessment module will match the second password set with the first password set. The first matching result is a set of login passwords that are successfully matched by the second login password in the second password set in the first password set. If a login password matching the second login password in the second password set is found in the first password set, for example, there is an intersection between the first password set and the second password set, it indicates that some passwords in the second password set have a potential risk of being subjected to a brute force attack.

[0045] By matching the second password set with the first password set to obtain a first matching result, the protection system can evaluate the security of the existing login passwords of the target terminal based on real brute force attack data, and provide specific response measures for login passwords that are at risk of brute force attacks, thereby preventing brute force attacks in advance and achieving the effect of improving the security of the target terminal.

[0046] Step S103: judging whether the login passwords in the second password set have a brute force attack risk based on the first matching result of the second password set.

[0047] In the first embodiment, the first matching result includes login passwords in the second password set that are at risk of being cracked. If the first matching result is not empty, that is, an element matching the second login password in the second password set is found in the first password set, indicating that some passwords used by the target terminal are at potential risk of being cracked. If the first matching result is not empty, a risk assessment report can be generated based on the first matching result, that is, pointing out the login passwords at risk in the target terminal and the recommended corrective measures, such as immediately changing the relevant passwords, strengthening the password complexity requirements, or implementing a stricter login attempt restriction policy.

[0048] In summary, the method for determining the risk of a blasting attack provided in the first embodiment of the present application updates the first password set according to the first login password in the first login information when it is detected that there is blasting attack behavior information in the first login information of the terminal for the first business system, wherein the first password set includes login passwords that have been subjected to blasting attacks in the past. In this way, more first password sets that are close to the blasting behavior can be captured, and a real-time updated and more realistic blasting attack password library can be constructed. Moreover, by matching the first password set with the second password set of the target business system, the security of the login password of the target system can be evaluated in real time, overcoming the lag and one-sidedness of traditional evaluation methods, identifying login passwords that have been mastered by attackers or are at risk of being cracked by brute force, thereby providing more real-time and comprehensive feedback on the password security status, and then taking protective measures in advance to reduce the possibility of successful blasting, thereby achieving the effect of significantly improving the overall security and protection level of the enterprise system.

[0049] Optionally, in the method for determining the risk of a brute force attack provided in Example 1 of the present application, before updating the first password set based on the first login password in the first login information, the method further includes: comparing the first login information with the target characteristic information, and determining that the first login information contains brute force attack behavior information if the comparison result is that the first login information conforms to the target characteristic information.

[0050] In an optional embodiment, when the protection system detects a login request (first login request) that fails authentication, the brute force password capture module will collect the first login information of the login request, including the login IP (for example, the first login IP), login username, login password, etc. Then, the brute force password capture module compares and analyzes the first login information with the preset target feature information. The brute force password capture module will preset a series of features of brute force attacks as target feature information, for example, the login password in the first login information has a high match with the preset weak password, the login password in the first login information has a higher match with the brute force passwords of other known attacked terminals than the preset match, etc.

[0051] In another optional embodiment, the brute force password capture module continuously monitors whether the first login IP that initiates the first login request initiates multiple second login requests that fail authentication (for example, initiates 500 login requests that fail authentication, 500 being the above-mentioned preset number of times, and the preset number of times may also be other integers, which are not specifically limited in the first embodiment). If the first login IP initiates multiple second login requests that fail authentication, the first login IP is determined to be an abnormal IP.

[0052] When the first login IP is determined to be an abnormal IP, the brute force password capture module will determine that the first login information contains brute force attack behavior information, that is, the first login request corresponding to the first login information contains brute force attack behavior. At this time, the brute force password capture module continues to collect all password attempts initiated by the abnormal IP through pseudo login processing, and constructs a more comprehensive and real brute force password set, that is, the above-mentioned first password set, for subsequent brute force attack risk assessment.

[0053] By determining whether the first login IP is an abnormal IP, potential attackers can be identified in the early stages of a brute force attack. By collecting all passwords attempted by attackers, a database of real brute force attack passwords can be built and continuously improved, providing more accurate data support for subsequent risk assessment and security protection.

[0054] Optionally, in the method for determining the risk of a blasting attack provided in Example 1 of the present application, the first login information also includes a first login IP. When the comparison result is that the first login information meets the target characteristic information, the above method also includes: determining that the first login IP is an abnormal IP, and receiving a third login request initiated by the abnormal IP, responding to the third login request, and returning authentication failure information, the third login request at least includes: a third login password; updating the first password set based on the third login password to obtain an updated first password set; determining the association relationship between the login passwords in the updated first password set and the target information, wherein the target information includes at least one of the following: attribute information of the login user, a preset weak password, and preset characters; expanding the login passwords in the updated first password set based on the association relationship, and using the expanded first password set as the first password set.

[0055] In the first embodiment, the brute force password capture module compares and analyzes the first login information with the preset target feature information. If the first login information is highly consistent with the target feature information during the comparison process, the brute force password capture module will determine that the first login IP is an abnormal IP, that is, an IP that may be undergoing a brute force attack.

[0056] When the brute force password capture module identifies that an abnormal IP is attempting brute force cracking, the brute force password capture module will continue to receive the third login request initiated by the abnormal IP. The third login request contains the new password attempted by the brute force attacker, namely the third login password. When the brute force password capture module responds to the third login request, regardless of whether the third login password provided by the attacker is correct, it will return the authentication failure information to allow the attacker to continue trying, thereby capturing as much brute force password information as possible, and then more effectively analyzing the attacker's strategy and providing more accurate defense measures.

[0057] Then, after receiving the third login request and returning the failure information, the brute force password capture module will update its first password set based on the third login password. The first password set is a set of brute force passwords collected by the brute force password capture module. The brute force password capture module continuously obtains new brute force password information from the passwords attempted by the attacker to build a brute force password library that is more comprehensive and truly reflects the attacker's strategy. The update process will add the third login password to the first password set, and may also perform some deduplication and sorting to ensure the validity and accuracy of the set.

[0058] Secondly, the blasting password capture module will further analyze the updated first password set to determine the association between the login password and the target information (which may include: attribute information of the logged-in user, such as the login username, the system name of the login system, and may also include preset weak passwords, preset characters or application-specific information, etc.). For example, if the blasting password attempted by the attacker is "login username + 123", the blasting password capture module will identify the association between the blasting password and the login username.

[0059] Finally, the brute force password capture module will expand the login passwords in the updated first password set based on the captured associations, that is, the brute force password capture module will not only store the brute force passwords actually attempted by the attacker, but also generate a series of possible password variants based on the associations to enhance the coverage of the first password set. The expanded first password set will be reused as the first password set for subsequent brute force attack risk assessments.

[0060] By continuously collecting password information from brute force cracking attempts and using the inherent correlation of this information for intelligent expansion and continuous enrichment of the first password set, it not only helps the system understand the attacker's behavior patterns in real time, but also provides more comprehensive and targeted data support for subsequent password security assessments, thereby more effectively identifying and preventing potential brute force cracking risks, enabling the protection system to more accurately predict the passwords that attackers may try, thereby improving the accuracy of risk assessment and the effectiveness of protection.

[0061] Optionally, in the method for determining the risk of a brute force attack provided in Example 1 of the present application, the first login information is compared with the target characteristic information, including: when the similarity between the login password in the first login information and the preset login password of the terminal is less than a second preset value, determining that the comparison result is that the first login information meets the target characteristic information; or when the similarity between the login password in the first login information and the third password set of other terminals is greater than a third preset value, determining that the comparison result is that the first login information meets the target characteristic information, wherein the third password set is a password set that has a risk of a brute force attack; or when the number of authentication failure requests initiated by the first login IP is greater than a preset number, and the number of times the first login IP to which the first login information belongs to the first business system within a first preset time period is greater than a fourth preset value, determining that the comparison result is that the first login information meets the target characteristic information; or when the number of login requests initiated by the first login IP within the second preset time period is greater than a fifth preset value, determining that the comparison result is that the first login information meets the target characteristic information.

[0062] In an optional embodiment, the brute force password capture module stores a preset weak password set, and the weak passwords in the weak password set are usually composed of common letters, numbers, and special characters, which are easily exploited by brute force attacks. If the first login password matches the weak password in the weak password set, it is determined that the attacker may be using the weak password for brute force cracking, that is, the first login information meets the target feature information, and there is a risk of brute force attack.

[0063] If multiple first login passwords are collected, each of the multiple first login passwords is matched with a weak password in the weak password set, and the overlap rate is determined according to the ratio of the first login passwords that successfully match the weak password set to the multiple first login passwords. If the overlap rate between the first login password and the preset weak password set is greater than a first preset value (for example, 80%, which is not specifically limited in the first embodiment), the brute force password capture module will believe that the attacker may be using the weak password set for brute force cracking, that is, the first login information meets the target feature information, and there is a risk of brute force attack.

[0064] In an optional embodiment, the preset login password of the target terminal is a login password that is known and actually used in the target terminal, and they may be stored in a database or configuration file. The similarity between the first login password and any preset login password of the target terminal is calculated to determine whether the password attempted by the attacker has a relationship or association with the real password in the target terminal. If the similarity between the first login password and all preset login passwords is less than a second preset value, that is, the password attempted by the attacker is very different from the existing password, the brute force password capture module will consider that there is a risk of brute force attack, because the real login user usually does not try a password that is too different from his actual password.

[0065] In an optional embodiment, the brute force password capture module collects a third password set from other terminals known to have been subjected to brute force cracking, which includes a group of passwords that have been determined to have a risk of brute force attacks. The similarity between the first login password and the passwords in the third password set is calculated. If the similarity between the first login password and the third password set is greater than a third preset value (for example, 80%, which is not specifically limited in this embodiment 1), that is, the password attempted by the attacker is highly similar to the known brute force attack risk password set, the brute force password capture module will determine that the first login information has a risk of brute force attacks, that is, it meets the target feature information.

[0066] By setting different thresholds and comparison standards, the brute force password capture module can analyze the attacker's behavior from multiple angles and more accurately determine whether a brute force attack is occurring. It can not only identify attacks early, but also enhance the system's early warning and defense capabilities against brute force attacks by continuously updating the first password set, effectively reducing the risk of the system being brute force cracked.

[0067] In an optional embodiment, when the brute force password capture module detects that the first login IP has initiated a login request (fourth login request) using an unknown username (i.e., a username that does not exist in the target terminal), this usually indicates that the attacker is attempting a brute force attack, especially when the attacker frequently uses incorrect usernames, and this behavior is highly consistent with brute force attack behavior. Therefore, the brute force password capture module will determine that the comparison result is that the first login information meets the target feature information, that is, there is a risk of brute force attack.

[0068] In an optional embodiment, the brute force password capture module monitors the number of failed authentication login requests initiated by the first login IP. If the number of failed authentications exceeds a preset number (for example, more than 30 failed authentication attempts), and within a first preset time period (for example, within 1 hour), the number of target terminal login attempts by the first login IP exceeds a fourth preset value (for example, logging into 10 different terminals, applications or systems), this indicates that the activity pattern of the first login IP is consistent with the characteristics of a brute force attack, and the brute force password capture module will determine that the comparison result is a risk of a brute force attack.

[0069] In an optional embodiment, the brute force password capture module monitors the total number of login requests initiated by the first login IP within a second preset time period (e.g., within 1 hour). If the total number of requests exceeds a fifth preset value (e.g., 200 login requests were initiated within 1 hour), this indicates that the attacker is attempting to log in at a high frequency, which is also a typical behavior of a brute force attack. Therefore, the brute force password capture module will determine that the comparison result is that the first login information meets the target feature information, and there is a risk of brute force attack.

[0070] By monitoring and analyzing the login behavior of the first login IP, including the use of unknown user names, the number of authentication failures, the number of target terminal logins, and the frequency of login requests, it is possible to more accurately determine whether a brute force attack is being carried out. Compared with the traditional brute force detection based on a single threshold (such as the number of login failures), it is more comprehensive and intelligent, can adapt to the attack mode in different scenarios, and improve the detection efficiency and accuracy of brute force attack risks.

[0071] In addition, when the brute force password capture module determines that the comparison results indicate that there is a risk of brute force cracking, it will take corresponding measures, such as capturing all passwords attempted by the attacker to build a more comprehensive first password set, or notifying the security administrator to take further countermeasures, such as strengthening password policies, banning the attacker's IP, etc., to protect the target terminal from the threat of brute force cracking attacks.

[0072] Optionally, in the method for determining the risk of a blasting attack provided in Example 1 of the present application, obtaining a second password set for the target business system includes: obtaining a second login password for each terminal in at least one terminal for logging into the target business system and a second login user name for each terminal; determining a password verification scheme for each terminal in at least one terminal for logging into the target business system; and generating a second password set based on the second login password for each terminal in at least one terminal, the second login user name for each terminal, and the password verification scheme.

[0073] In the first embodiment, the login password collection module collects the second login user name and the second login password of each terminal in at least one terminal in different business systems (i.e., the target business system mentioned above, which can be the first business system or the second business system), i.e., the user name and password actually used for login. These second login passwords may be stored in various locations, including but not limited to configuration files, databases, or protected by other encryption methods.

[0074] Then, the login password collection module generates a second password set based on the collected second login user name of each terminal, the second login password of each terminal and the password verification scheme. The second password set contains the login password information of all terminals (or applications in the terminal) collected from different business systems, as well as the password verification scheme required to verify these login passwords. The generated second password set will be used for subsequent brute force attack risk assessment. By comparing these passwords with possible brute force password sets, potential security threats to the target terminal can be identified, especially for passwords that may be attacked by brute force.

[0075] By collecting the second login user name, second login password and password verification scheme through the login password collection module, it is possible to accurately determine the password verification scheme based on the network policies of different business systems and the password storage method, thereby more accurately evaluating the security of the second login password. The generated second password set will provide detailed data support for subsequent risk assessments and help improve the security protection capabilities of the overall system.

[0076] Optionally, in the method for determining the risk of blasting attacks provided in Example 1 of the present application, the password verification scheme includes at least one of the following: a first verification method, a second verification method, and a third verification method. The first verification method is a method of directly verifying based on the login password, the second verification method is a method of verifying after encrypting the login password, and the third verification method is a verification method other than the first verification method and the second verification method.

[0077] In an optional embodiment, the login password collection module determines the password verification scheme for each second login password according to the network policies of different business systems, and is used to verify the collected second login passwords. The password verification scheme can be divided into three categories: the first verification method, namely the direct verification method, that is, when the password is stored or transmitted in plain text, it can be directly compared with the password provided by the user to verify its correctness; the second verification method, namely the encryption verification method, for passwords stored using an encryption algorithm (such as a hash function), the password provided by the user needs to be encrypted using the same encryption algorithm, and then compared with the stored encrypted password; the third verification method, namely other verification methods in addition to the above two methods, which may involve more complex identity authentication mechanisms, such as multi-factor authentication (MFA), biometrics, time-based one-time passwords (TOTP), etc.

[0078] Optionally, in the method for determining the risk of brute force attacks provided in Example 1 of the present application, the second password set is matched with the updated first password set to obtain a first matching result of the second password set, including: when the password verification scheme corresponding to the second password set is the first verification method, the second login password in the second password set is matched with the first login password in the updated first password set to obtain a first matching result; when the password verification scheme is the second verification method, the second login password is encrypted, and the encrypted second login password is matched with the first login password to obtain a first matching result; or the first login password is decrypted, and the second login password is matched with the decrypted first login password to obtain a first matching result; when the password verification scheme is the third verification method, a simulated login request is sent to the target business system, and the first matching result is determined based on whether the response result of the simulated login request returned by the target business system indicates that the login is successful, wherein the simulated login request includes: the second login password and the corresponding login user name.

[0079] In an optional embodiment, when the password verification scheme is determined to be the first verification mode, that is, the second login password is stored in plain text, the brute force attack risk assessment module directly matches the second login password with the first login password (that is, a password in the possible brute force password set), and determines whether the two are the same through simple character equivalence matching, thereby obtaining a first matching result.

[0080] In an optional embodiment, if the password verification scheme is the second verification method, that is, the password is stored in encrypted form, the brute force attack risk assessment module needs to perform additional processing operations, including but not limited to one of the following operations: encrypting the second login password through the same encryption algorithm, and then performing equivalent matching between the encrypted second login password and the first login password to obtain a first matching result; decrypting the first login password, and then matching the second login password with the decrypted first login password to obtain the first matching result. In this way, whether the password is stored in encrypted form or transmitted in encrypted form, the validity of the second login password can be accurately verified through the correct encryption or decryption process.

[0081] Exemplarily, the encrypted password is used to perform character equivalent matching with the collected password ciphertext, for example, by checking all login user names, login passwords (i.e., the second login password mentioned above) and their encrypted formats under the Linux system user password in the / etc / shadow query system, the second login password is encrypted using the encryption algorithm in the encryption format, and the encrypted second login password is equivalently matched with the first login password to obtain a first matching result. Alternatively, the user password in the Windows system is stored in the SAM database, and the user password hash can be obtained by reading the SAM. The second login password is encrypted using the encryption algorithm corresponding to the Windows system version (e.g., the NTLM algorithm), and the first login password and the encrypted second login password are equivalently matched to obtain a first matching result.

[0082] In an optional embodiment, for a password verification scheme in a password verification scenario that uses an unknown encryption algorithm or a complex multi-factor authentication mechanism, i.e., the third verification method, the brute force attack risk assessment module cannot directly verify the password through the above method. In this case, the brute force attack risk assessment module will generate a simulated login request based on the preset login user name and the second login port processed by the preset method, and attempt to log in through the model login request. If the login is successful, it means that the second login password matches a password in the system. At this time, the brute force attack risk assessment module matches the second login password with the first login password to obtain a first matching result. The second login password processed by the preset method includes but is not limited to: the second login password processed by the preset algorithm, the encrypted second login password, the decrypted second login password, etc.

[0083] By taking corresponding processing measures according to different password verification schemes, and then using an equivalent matching method or an attempted login method to verify whether the second login password exists in the first login password set (i.e., the possible brute force password set), a first matching result is obtained, which will be used for subsequent security assessments to help identify risky passwords that have been cracked by brute force in the business system, so that timely measures can be taken to strengthen password security and prevent potential attacks.

[0084] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0085] Embodiment 2

[0086] The second embodiment of the present application also provides a device for determining the risk of explosive attack. It should be noted that the device for determining the risk of explosive attack in the second embodiment of the present application can be used to execute the method for determining the risk of explosive attack provided in the first embodiment of the present application. The device for determining the risk of explosive attack provided in the second embodiment of the present application is introduced below.

[0087] Figure 3 Schematic diagram of a device for determining blasting attack risk according to Embodiment 2 of the present application. Figure 3 As shown, the device includes: a first updating unit 301, a matching unit 302 and a judging unit 303.

[0088] Specifically, the first updating unit 301 is used to update the first password set according to the login password in the first login information when detecting that the terminal has a brute force attack behavior information on the first login information of the first business system, wherein the first password set includes login passwords that have been subjected to brute force attacks in the past.

[0089] The matching unit 302 is used to obtain a second password set of the target business system, match the second password set with the updated first password set, and obtain a first matching result of the second password set, wherein the target business system is the second business system; or, the target business system is the first business system, and the password set of the first business system includes a password updated from the login password in the first login information.

[0090] The judging unit 303 is used to judge whether the login passwords in the second password set have a brute force attack risk according to the first matching result of the second password set.

[0091] Optionally, in the device for determining the risk of a blasting attack provided in Example 2 of the present application, the device further includes: a comparison unit, for comparing the first login information with the target characteristic information, and determining that the first login information contains blasting attack behavior information when the comparison result is that the first login information matches the target characteristic information.

[0092] Optionally, in the device for determining the risk of blasting attack provided in Example 2 of the present application, the above-mentioned first login information also includes a first login IP, and the device also includes: a response unit, used to determine that the first login IP is an abnormal IP, and receive a third login request initiated by the abnormal IP, respond to the third login request, and return authentication failure information, the third login request at least includes: a third login password; a second update unit, used to update the first password set according to the third login password to obtain an updated first password set; a second determination unit, used to determine the association relationship between the login passwords in the updated first password set and the target information, wherein the target information includes at least one of the following: attribute information of the login user, a preset weak password, and a preset character; an expansion unit, used to expand the login passwords in the updated first password set according to the association relationship, and use the expanded first password set as the first password set.

[0093] Optionally, in the device for determining the risk of a blasting attack provided in Example 2 of the present application, the comparison unit includes: a first determination subunit, for determining that the comparison result is that the first login information meets the target characteristic information when the similarity between the login password in the first login information and the preset login password of the target terminal is less than a second preset value; or a second determination subunit, for determining that the comparison result is that the first login information meets the target characteristic information when the similarity between the login password in the first login information and the third password set of other terminals is greater than a third preset value, wherein the third password set is a password set with a risk of a blasting attack; or a third determination subunit, for determining that the comparison result is that the first login information meets the target characteristic information when the number of authentication failure requests initiated by the first login IP to which the first login information belongs is greater than a preset number, and the number of times the first login IP logs into the first business system within a first preset time period is greater than a fourth preset value; or a fourth determination subunit, for determining that the comparison result is that the first login information meets the target characteristic information when the number of login requests initiated by the first login IP within the second preset time period is greater than a fifth preset value.

[0094] Optionally, in the device for determining the risk of blasting attacks provided in Embodiment 2 of the present application, the above-mentioned matching unit 303 includes: an acquisition subunit, used to acquire the second login password of each terminal in at least one terminal for logging into the target business system and the second login user name of each terminal; a fifth determination subunit, used to determine the password verification scheme for each terminal in at least one terminal for logging into the target business system; and a generation subunit, used to generate a second password set based on the second login password of each terminal in at least one terminal, the second login user name of each terminal and the password verification scheme.

[0095] Optionally, in the device for determining the risk of blasting attacks provided in Example 2 of the present application, the above-mentioned password verification scheme includes at least one of the following: a first verification method, a second verification method, and a third verification method. The first verification method is a method of directly verifying based on the login password, the second verification method is a method of verifying after encrypting the login password, and the third verification method is a verification method other than the first verification method and the second verification method.

[0096] Optionally, in the device for determining the brute force attack risk provided in Example 2 of the present application, the above-mentioned matching unit 303 includes: a first matching subunit, which is used to match the second login password in the second password set with the first login password in the updated first password set to obtain a first matching result when the password verification scheme corresponding to the second password set is the first verification method; a second matching subunit, which is used to encrypt the second login password and match the encrypted second login password with the first login password to obtain a first matching result when the password verification scheme is the second verification method; or to decrypt the first login password and match the second login password with the decrypted first login password to obtain a first matching result; a third matching subunit, which is used to send a simulated login request to the target business system when the password verification scheme is the third verification method, and determine the first matching result according to whether the response result of the simulated login request returned by the target business system indicates that the login is successful, wherein the simulated login request includes: the second login password and the corresponding login user name.

[0097] The device for determining the blasting attack risk includes a processor and a memory. The first updating unit 301, matching unit 302 and judgment unit 303 are all stored in the memory as program units, and the processor executes the program units stored in the memory to implement corresponding functions.

[0098] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set, and the detection accuracy of the brute force attack risk in the login password can be improved by adjusting the kernel parameters.

[0099] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0100] Embodiment 3 of the present invention provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, the steps of the method for determining the blasting attack risk provided in any of the aforementioned embodiments are implemented.

[0101] Embodiment 4 of the present invention provides a processor, and the processor is used to run a program, wherein when the program is running, the steps of the method for determining the blasting attack risk provided by any of the aforementioned embodiments are executed.

[0102] like Figure 4 As shown, embodiment 5 of the present invention provides an electronic device, the device includes a processor, a memory, and a program stored in the memory and executable on the processor, and the processor implements the following steps when executing the program: when it is detected that there is brute force attack behavior information of the terminal for the first login information of the first business system, the first password set is updated according to the login password in the first login information, wherein the first password set includes login passwords that have been historically subjected to brute force attacks; a second password set of the target business system is obtained, and the second password set is matched with the updated first password set to obtain a first matching result of the second password set, wherein the target business system is the second business system; or the target business system is the first business system, and the password set of the first business system includes passwords updated from the login passwords in the first login information; and according to the first matching result of the second password set, it is determined whether there is a brute force attack risk for the login passwords in the second password set.

[0103] The devices in this article can be servers, PCs, PADs, mobile phones, etc.

[0104] The present application also provides a computer program product, which, when executed on a computer device, is suitable for executing a program that is initialized with the following method steps: when it is detected that a terminal has information about a brute force attack on first login information of a first business system, updating a first password set based on the login password in the first login information, wherein the first password set includes login passwords that have been historically subjected to brute force attacks; obtaining a second password set of a target business system, matching the second password set with the updated first password set to obtain a first matching result of the second password set, wherein the target business system is the second business system; or, the target business system is the first business system, and the password set of the first business system includes passwords updated from the login passwords in the first login information; judging whether the login passwords in the second password set have a risk of a brute force attack based on the first matching result of the second password set.

[0105] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0106] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0107] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0108] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0109] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0110] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0111] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0112] The embodiments or examples of the present disclosure are not exhaustive, but are only illustrative of some embodiments or examples, and are not intended to be specific limitations on the scope of protection of the present disclosure. In the absence of contradiction, each step in a certain embodiment or example can be implemented as an independent example, and the steps can be combined arbitrarily. For example, the scheme after removing some steps in a certain embodiment or example can also be implemented as an independent example, and the order of the steps in a certain embodiment or example can be arbitrarily exchanged. In addition, the optional methods or optional examples in a certain embodiment or example can be combined arbitrarily; in addition, the various embodiments or examples can be combined arbitrarily, for example, some or all steps of different embodiments or examples can be combined arbitrarily, and a certain embodiment or example can be combined arbitrarily with the optional methods or optional examples of other embodiments or examples.

[0113] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0114] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0115] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for determining blasting attack risk, characterized in that: The method comprises: When it is detected that the terminal has brute force attack behavior information on the first login information of the first business system, updating the first password set according to the login password in the first login information, wherein the first password set includes login passwords that have been subjected to brute force attacks in the past; Acquire a second password set of a target business system, match the second password set with the updated first password set, and obtain a first matching result of the second password set, wherein the target business system is the second business system; or the target business system is the first business system, and the password set of the first business system includes a password updated from the login password in the first login information; According to the first matching result of the second password set, it is determined whether the login passwords in the second password set have a brute force attack risk.

2. The method according to claim 1, characterized in that The method further comprises: The first login information is compared with the target characteristic information, and when the comparison result shows that the first login information matches the target characteristic information, it is determined that the first login information contains blasting attack behavior information.

3. The method according to claim 2, characterized in that The first login information also includes a first login IP. When the comparison result shows that the first login information matches the target feature information, the method further includes: Determine that the first login IP is an abnormal IP, receive a third login request initiated by the abnormal IP, respond to the third login request, and return authentication failure information, wherein the third login request at least includes: a third login password; Updating the first password set according to the third login password to obtain an updated first password set; Determine an association relationship between the login password in the updated first password set and target information, wherein the target information includes at least one of the following: attribute information of the login user, a preset weak password, and a preset character; The login passwords in the updated first password set are expanded according to the association relationship, and the expanded first password set is used as the first password set.

4. The method according to claim 2 or 3, characterized in that: Comparing the first login information with the target characteristic information includes: When the similarity between the login password in the first login information and the preset login password of the terminal is less than a second preset value, determining that the comparison result is that the first login information meets the target feature information; or In the case where the similarity between the login password in the first login information and the third password set of other terminals is greater than a third preset value, determining that the comparison result is that the first login information meets the target feature information, wherein the third password set is a password set with a risk of brute force attack; or When the number of authentication failure requests initiated by the first login IP to which the first login information belongs is greater than a preset number, and the number of times the first login IP logs into the first business system within a first preset time period is greater than a fourth preset value, it is determined that the comparison result is that the first login information meets the target feature information; or When the number of login requests initiated by the first login IP within the second preset time period is greater than the fifth preset value, it is determined that the comparison result is that the first login information meets the target characteristic information.

5. The method according to claim 1, characterized in that Obtain the second password set of the target business system, including: Obtaining a second login password for each terminal in at least one terminal to log into the target business system and a second login user name of each terminal; Determining a password verification scheme for each of the at least one terminal to log into the target business system; The second password set is generated according to the second login password of each terminal in the at least one terminal, the second login user name of each terminal, and the password verification scheme.

6. The method according to claim 5, characterized in that The password verification scheme includes at least one of the following: a first verification method, a second verification method, and a third verification method. The first verification method is a method of directly verifying based on the login password, the second verification method is a method of verifying after encrypting the login password, and the third verification method is a verification method other than the first verification method and the second verification method.

7. The method according to claim 1, 5 or 6, characterized in that: Matching the second password set with the updated first password set to obtain a first matching result of the second password set includes: When the password verification scheme corresponding to the second password set is the first verification mode, matching the second login password in the second password set with the updated first login password in the first password set to obtain the first matching result; When the password verification scheme is the second verification method, encrypting the second login password, matching the encrypted second login password with the first login password, and obtaining the first matching result; or decrypting the first login password, matching the second login password with the decrypted first login password, and obtaining the first matching result; When the password verification scheme is the third verification method, a simulated login request is sent to the target business system, and the first matching result is determined based on whether the response result of the simulated login request returned by the target business system indicates that the login is successful, wherein the simulated login request includes: the second login password and the corresponding login user name.

8. A device for determining blasting attack risk, characterized in that: include: A first updating unit is configured to update a first password set according to a login password in the first login information when it is detected that a terminal has brute force attack behavior information against the first login information of the first business system, wherein the first password set includes login passwords that have been subjected to brute force attacks in the past; a matching unit, configured to obtain a second password set of a target business system, match the second password set with the updated first password set, and obtain a first matching result of the second password set, wherein the target business system is the second business system; or the target business system is the first business system, and the password set of the first business system includes a password updated from the login password in the first login information; The judging unit is used to judge whether the login passwords in the second password set have a brute force attack risk according to the first matching result of the second password set.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes stored computer instructions, wherein when the computer instructions are executed by a processor, the method for determining the blasting attack risk according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method for determining the risk of a blasting attack as described in any one of claims 1 to 7.

Images