Communication security detection method and computing device

Abstract

The embodiment of the invention provides a communication security detection method and computing equipment. In the method, in the authentication process of a first computing device and a second computing device, the first computing device obtains authentication behavior data corresponding to the second computing device. In an identity authentication stage of an authentication process, a first computing device obtains an identity authentication request sent by a second computing device; the first computing device determines whether an authentication behavior to which the identity authentication request belongs is an abnormal behavior according to authentication behavior data corresponding to the second computing device; if yes, the first computing device disconnects the connection between the first computing device and the second computing device. The detection accuracy of the abnormal behavior is improved, and the detection accuracy of the communication security is further improved.

Description

Technical Field

[0001] The present application relates to the technical field of computing devices, and in particular to a communication security detection method and computing device. Background Art

[0002] Secure Shell (SSH) is a network security protocol that implements secure access and file transfer through encryption and authentication mechanisms. SSH supports identity authentication using passwords.

[0003] In order to improve the security of identity authentication using passwords, in the related art, the first computing device can set a maximum number of attempts M. However, the second terminal device can obtain the password by brute force, resulting in the problem of low security in the method in the related art. Summary of the invention

[0004] The embodiments of the present application provide a communication security detection method and computing device, which improve the detection accuracy of abnormal behavior and thus improve the detection accuracy of communication security.

[0005] In a first aspect, an embodiment of the present application provides a communication security detection method, which is applied to a first computing device, and the method includes:

[0006] During the authentication process between the first computing device and the second computing device, obtaining authentication behavior data corresponding to the second computing device;

[0007] During the identity authentication phase of the authentication process, obtaining an identity authentication request sent by the second computing device;

[0008] Determine, based on the authentication behavior data corresponding to the second computing device, whether the authentication behavior to which the identity authentication request belongs is an abnormal behavior;

[0009] If so, the connection between the first computing device and the second computing device is disconnected.

[0010] In this scheme, the first computing device can obtain the authentication behavior data corresponding to the second computing device during the authentication process between the first computing device and the second computing device. The first computing device can obtain the authentication request sent by the second computing device during the authentication stage of the authentication process. The first computing device can disconnect the connection between the first computing device and the second computing device when it is determined that the authentication behavior to which the authentication request belongs is an abnormal behavior based on the authentication behavior data corresponding to the second computing device, so as to prevent the second computing device from using continuous attempts to brute force the password. The method of the embodiment of the present application improves the detection accuracy of communication security and improves the security of authentication. In addition, compared with the related art, it takes a long time to configure the firewall to prevent the computing device to which the malicious IP address belongs from authenticating, and there may be a situation where the computing device switches the IP address to bypass the firewall, resulting in a low detection accuracy of communication security. The method of the embodiment of the present application can use the authentication behavior data reflecting the authentication behavior of the second computing device to determine whether the authentication behavior is an abnormal behavior, thereby improving the detection accuracy of abnormal behavior, thereby improving the detection accuracy of communication security and improving the security of authentication.

[0011] In one implementation, determining whether the authentication behavior to which the identity authentication request belongs is an abnormal behavior according to the authentication behavior data corresponding to the second computing device includes:

[0012] Query the historical anomaly database to obtain historical anomaly data;

[0013] Determine whether historical abnormal data matches the authentication behavior data;

[0014] If so, the authentication behavior is determined to be abnormal behavior;

[0015] If not, determine whether the authentication behavior is an abnormal behavior based on the identity authentication result; wherein the identity authentication result is obtained by performing identity authentication processing on the identity authentication request.

[0016] In this scheme, after obtaining the identity authentication request, the first computing device can perform identity authentication processing on the identity authentication request to obtain the identity authentication result. The first computing device can determine that the second computing device is a device that brute-force cracks the password by re-establishing a connection to restart the authentication process when it is determined that the historical abnormal data matches the authentication behavior data. The first computing device can determine that the authentication behavior is an abnormal behavior and disconnect the first computing device from the second computing device. The first computing device can disconnect the first computing device from the second computing device when it is determined that the historical abnormal data does not match the authentication behavior data and when it is determined that the authentication behavior is an abnormal behavior based on the identity authentication result. By combining the above-mentioned method of using the authentication behavior data to determine whether the authentication behavior is an abnormal behavior with the identity authentication result to determine whether the authentication behavior is an abnormal behavior, the detection accuracy of abnormal behavior is improved, thereby improving the detection accuracy of communication security.

[0017] In one implementation, determining whether the authentication behavior is an abnormal behavior based on the identity authentication result includes:

[0018] If the identity authentication result indicates that the authentication failed, the number of failures is increased by 1 to obtain an updated number of failures;

[0019] Determine whether the number of failures after the update reaches a preset number;

[0020] If so, the authentication behavior is determined to be abnormal behavior.

[0021] In this solution, when the identity authentication result indicates that the authentication failed, the first computing device can add 1 to the number of failures to obtain an updated number of failures. When the first computing device determines that the updated number of failures reaches a preset number, it can determine that the authentication behavior is an abnormal behavior and disconnect the first computing device from the second computing device. By using the number of authentication failures indicated by the identity authentication result to determine whether the authentication behavior is an abnormal behavior, the detection accuracy of abnormal behavior is improved, thereby improving the detection accuracy of communication security.

[0022] In one implementation, the method further includes:

[0023] The supplemented authentication behavior data is stored as historical abnormality data in a historical abnormality database; wherein the supplemented authentication behavior data is obtained by supplementing the authentication behavior data according to the response time of the identity authentication request when the identity authentication result indicates that the authentication has failed.

[0024] In this solution, the first computing device can store the supplemented authentication behavior data as historical abnormal data in the historical abnormal database. In this way, the historical abnormal database can be newly processed, so that when the second computing device restarts the authentication process to try to crack the password by brute force, the new authentication behavior of the second computing device can be directly determined as abnormal behavior based on the historical abnormal data (supplemented authentication behavior data), thereby improving the detection accuracy and efficiency of communication security.

[0025] In one implementation, the method further includes:

[0026] If not, the supplemented authentication behavior data will be determined as the authentication behavior data corresponding to the second computing device; wherein the supplemented authentication behavior data is obtained by supplementing the authentication behavior data according to the response time of the identity authentication request when the identity authentication result indicates that the authentication has failed.

[0027] In this solution, the second computing device can determine that the authentication behavior is not abnormal behavior when it is determined that the number of failures after the update does not reach the preset number, and determine the supplemented authentication behavior data as the authentication behavior data corresponding to the second computing device. Through the above method, the authentication behavior data corresponding to the second computing device can truly and comprehensively reflect the authentication behavior of the second computing device, and then when the second computing device sends a new identity authentication request, the first computing device can determine whether the authentication behavior is abnormal behavior based on the authentication behavior data (supplemented authentication behavior data), thereby improving the detection accuracy of abnormal behavior and thus improving the detection accuracy of communication security.

[0028] In one implementation, the authentication behavior data includes a device identification;

[0029] Determine whether historical abnormal data matches authentication behavior data, including:

[0030] Determine whether the historical device identification in the historical abnormal data is consistent with the device identification;

[0031] If so, it is determined that the historical abnormal data matches the authentication behavior data.

[0032] In this scheme, by comparing the historical device identification in the historical abnormal data with the device identification in the authentication behavior data, it is possible to quickly determine whether the authentication behavior is abnormal behavior, thereby improving the detection speed of abnormal behavior and further improving the detection speed of communication security.

[0033] In one implementation, the device identification is obtained during the connection establishment phase of the authentication process.

[0034] In this solution, the device identification is obtained during the connection establishment phase of the authentication process, so that the authentication behavior data can be quickly obtained.

[0035] In one implementation, the authentication behavior data includes device configuration information, the device configuration information includes a usage version number, a usage algorithm, and a data volume of at least one response message; the method further includes:

[0036] If not, determine whether multiple conditions are met respectively;

[0037] If not, it is determined that the historical abnormal data does not match the authentication behavior data;

[0038] Several conditions include:

[0039] The historical usage version number in the historical abnormal data is consistent with the usage version number;

[0040] The data volume of at least one historical response message in the historical abnormal data is consistent with the data volume of at least one response message;

[0041] The historical usage algorithm in the historical anomaly data is consistent with the usage algorithm.

[0042] In this scheme, based on the device identification reflecting the actual configuration of the second computing device, the first computing device can further determine whether the historical abnormal data matches the authentication behavior data from the perspective of the device configuration information, that is, determine whether the historical device configuration information of the computing device (abnormal computing device) corresponding to the historical abnormal data is consistent with the device configuration information of the second computing device, and then, if the historical device configuration information of the abnormal computing device is inconsistent with the device configuration information of the second computing device, determine that the first computing device and the abnormal computing device are not the same computing device, and accordingly, determine that the authentication behavior is not abnormal. The detection accuracy of abnormal authentication behavior is improved, and then the detection accuracy of communication security is improved, and then the security of authentication is improved.

[0043] In one implementation,

[0044] The version number used is obtained during the version number negotiation phase of the authentication process;

[0045] The algorithm used is obtained during the encryption algorithm negotiation phase of the authentication process;

[0046] The data volume of at least one response message includes at least one of the following: the data volume of a first response message obtained during the version number negotiation phase of the authentication process, the data volume of a second response message obtained during the encryption algorithm negotiation phase of the authentication process, and the data volume of a third response message and a fourth response message obtained during the key negotiation phase of the authentication process.

[0047] In this solution, through the above method, various information in the device configuration information can be obtained during the authentication process, and the device configuration information can be used as authentication behavior data, thereby achieving fast and accurate acquisition of authentication behavior data.

[0048] In one implementation, the authentication behavior data includes a response duration of at least one response message; and the method further includes:

[0049] If so, for any response message, the time difference rate corresponding to the response message is calculated according to the response time of the response message and the response time of the historical response messages in the historical abnormal data; the response message corresponds to the historical response message;

[0050] Calculate an average duration difference rate according to the duration difference rate corresponding to at least one response message;

[0051] According to the average duration difference rate, the matching coefficient is calculated;

[0052] When it is determined that the matching coefficient reaches a preset threshold, it is determined that the historical abnormal data matches the authentication behavior data.

[0053] In this scheme, based on the response time of at least one response message reflecting the network distance between the first computing device and the second computing device, and the computing time of the second computing device, the first computing device can, when determining that the device configuration information of the first computing device is consistent with the historical device configuration information of the abnormal computing device, further determine whether the historical abnormal data matches the authentication behavior data based on the matching coefficient (the matching coefficient reflects the matching degree between the response time of at least one response message and the response time of at least one historical response message), that is, determine whether the computing device corresponding to the historical abnormal data (abnormal computing device) is the same computing device as the second computing device corresponding to the authentication behavior data, and then, when it is determined that the two are the same computing device, determine the authentication behavior of the second computing device as abnormal behavior, and disconnect the first computing device from the second computing device, thereby improving the detection accuracy of abnormal behavior, thereby improving the detection accuracy of communication security, and thereby improving the security of authentication.

[0054] In one implementation, the response duration of at least one response message includes at least one of the following:

[0055] The response time of the first response message obtained during the version number negotiation phase of the authentication process;

[0056] The response duration of the second response message obtained during the encryption algorithm negotiation phase of the authentication process;

[0057] The response duration of the third response message and the response duration of the fourth response message obtained in the key negotiation phase of the authentication process;

[0058] The response time of the fifth response message obtained during the identity authentication phase of the authentication process;

[0059] The response duration of at least one retry response message obtained during the identity authentication phase of the authentication process.

[0060] In this scheme, through the above method, the response duration of at least one response message can be obtained during the authentication process, and then based on the response duration of at least one response message, it can be determined whether the authentication behavior of the second computing device is abnormal behavior, thereby improving the detection accuracy of abnormal behavior, thereby improving the detection accuracy of communication security, and thereby improving the security of authentication.

[0061] In one implementation, the device identification includes an Internet Protocol (IP) address of the second computing device.

[0062] In this scheme, the device identifier may include the Internet Protocol IP address of the second computing device, so that the identifier of the second computing device can reflect the identity of the second computing device, thereby enabling the first computing device to determine whether the authentication behavior of the second computing device is abnormal behavior based on the IP address of the second computing device and the IP address of the abnormal computing device included in the historical abnormal data, thereby improving the detection accuracy of abnormal behavior, thereby improving the detection accuracy of communication security, and thereby improving the security of authentication.

[0063] In a second aspect, an embodiment of the present application provides a communication security detection device, which is applied to a first computing device, and the device includes:

[0064] A processing module, used for obtaining authentication behavior data corresponding to the second computing device during the authentication process between the first computing device and the second computing device;

[0065] An acquisition module, used to acquire an identity authentication request sent by the second computing device during the identity authentication phase of the authentication process;

[0066] The processing module is further used to determine whether the authentication behavior to which the identity authentication request belongs is an abnormal behavior according to the authentication behavior data corresponding to the second computing device;

[0067] The processing module is further configured to disconnect the first computing device from the second computing device if yes.

[0068] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0069] In one implementation, the processing module is specifically configured to:

[0070] Query the historical anomaly database to obtain historical anomaly data;

[0071] Determine whether historical abnormal data matches the authentication behavior data;

[0072] If so, the authentication behavior is determined to be abnormal behavior;

[0073] If not, determine whether the authentication behavior is an abnormal behavior based on the identity authentication result; wherein the identity authentication result is obtained by performing identity authentication processing on the identity authentication request.

[0074] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0075] In one implementation, the processing module is specifically configured to:

[0076] If the identity authentication result indicates that the authentication failed, the number of failures is increased by 1 to obtain an updated number of failures;

[0077] Determine whether the number of failures after the update reaches a preset number;

[0078] If so, the authentication behavior is determined to be abnormal behavior.

[0079] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0080] In one implementation, the processing module is further configured to:

[0081] The supplemented authentication behavior data is stored as historical abnormality data in the historical abnormality database; wherein the supplemented authentication behavior data is obtained by supplementing the authentication behavior data according to the response time of the identity authentication request when the identity authentication result indicates that the authentication has failed.

[0082] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0083] In one implementation, the processing module is further configured to:

[0084] If not, the supplemented authentication behavior data will be determined as the authentication behavior data corresponding to the second computing device; wherein the supplemented authentication behavior data is obtained by supplementing the authentication behavior data according to the response time of the identity authentication request when the identity authentication result indicates that the authentication has failed.

[0085] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0086] In one implementation, the authentication behavior data includes a device identification;

[0087] Processing module, specifically used for:

[0088] Determine whether the historical device identification in the historical abnormal data is consistent with the device identification;

[0089] If so, it is determined that the historical abnormal data matches the authentication behavior data.

[0090] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0091] In one implementation, the device identification is obtained during the connection establishment phase of the authentication process.

[0092] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0093] In one implementation, the authentication behavior data includes device configuration information, and the device configuration information includes a usage version number, a usage algorithm, and a data volume of at least one response message; the processing module is further used to:

[0094] If not, determine whether multiple conditions are met respectively;

[0095] If not, it is determined that the historical abnormal data does not match the authentication behavior data;

[0096] Several conditions include:

[0097] The historical usage version number in the historical abnormal data is consistent with the usage version number;

[0098] The data volume of at least one historical response message in the historical abnormal data is consistent with the data volume of at least one response message;

[0099] The historical usage algorithm in the historical anomaly data is consistent with the usage algorithm.

[0100] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0101] In one implementation,

[0102] The version number used is obtained during the version number negotiation phase of the authentication process;

[0103] The algorithm used is obtained during the encryption algorithm negotiation phase of the authentication process;

[0104] The data volume of at least one response message includes at least one of the following: the data volume of a first response message obtained during the version number negotiation phase of the authentication process, the data volume of a second response message obtained during the encryption algorithm negotiation phase of the authentication process, and the data volume of a third response message and a fourth response message obtained during the key negotiation phase of the authentication process.

[0105] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0106] In one implementation, the authentication behavior data includes a response duration of at least one response message; and the processing module is further configured to:

[0107] If so, for any response message, the time difference rate corresponding to the response message is calculated according to the response time of the response message and the response time of the historical response messages in the historical abnormal data; the response message corresponds to the historical response message;

[0108] Calculate an average duration difference rate according to the duration difference rate corresponding to at least one response message;

[0109] According to the average duration difference rate, the matching coefficient is calculated;

[0110] When it is determined that the matching coefficient reaches a preset threshold, it is determined that the historical abnormal data matches the authentication behavior data.

[0111] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0112] In one implementation, the response duration of at least one response message includes at least one of the following:

[0113] The response time of the first response message obtained during the version number negotiation phase of the authentication process;

[0114] The response duration of the second response message obtained during the encryption algorithm negotiation phase of the authentication process;

[0115] The response duration of the third response message and the response duration of the fourth response message obtained in the key negotiation phase of the authentication process;

[0116] The response time of the fifth response message obtained during the identity authentication phase of the authentication process;

[0117] The response duration of at least one retry response message obtained during the identity authentication phase of the authentication process.

[0118] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0119] In one implementation, the device identification includes an Internet Protocol (IP) address of the second computing device.

[0120] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0121] In a third aspect, an embodiment of the present application provides a computing device, the computing device comprising a memory and a processor;

[0122] The memory is coupled to the processor;

[0123] Memory is used to store computer instructions;

[0124] The processor is used to execute computer instructions to enable the computing device to implement the method of the first aspect.

[0125] The computing device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0126] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the method of the first aspect.

[0127] When the computer-executable instructions in the computer-readable storage medium provided in the embodiment of the present application are executed by the processor, the technical solution shown in the above method embodiment can be implemented. The implementation principle and beneficial effects are similar and will not be repeated here.

[0128] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which is used to implement the method of the first aspect when the computer program is executed by a processor.

[0129] When the computer program in the computer program product provided in the embodiment of the present application is executed by a processor, the technical solution shown in the above method embodiment can be implemented. The implementation principle and beneficial effects are similar and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0130] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0131] Figure 1 A schematic diagram of a scenario of encrypted transmission based on the SSH protocol provided in an embodiment of the present application;

[0132] Figure 2 A schematic diagram of a communication security detection method provided in an embodiment of the present application;

[0133] Figure 3a A flowchart of a first embodiment of a communication security detection method provided in an embodiment of the present application;

[0134] Figure 3b A flowchart of an authentication process provided in an embodiment of the present application;

[0135] Figure 3c A schematic diagram of obtaining authentication behavior data provided in an embodiment of the present application;

[0136] Figure 4 A flow chart of a second embodiment of a communication security detection method provided in an embodiment of the present application;

[0137] Figure 5 A flowchart of a third embodiment of a communication security detection method provided in an embodiment of the present application;

[0138] Figure 6 A flowchart of a fourth embodiment of a communication security detection method provided in an embodiment of the present application;

[0139] Figure 7 A schematic diagram of the structure of a communication security detection device provided in an embodiment of the present application;

[0140] Figure 8 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0141] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments made by ordinary technicians in this field under the enlightenment of the embodiments belong to the scope of protection of the present application.

[0142] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0143] Glossary:

[0144] Transmission Control Protocol: (TCP) is a connection-oriented, reliable, byte stream-based transport layer communication protocol, mainly used to establish a reliable communication connection between two computing devices in a network.

[0145] Plain text transmission: refers to the transmission of data in an unencrypted form when sending or receiving data on the network. This means that any third party who intercepts the data can directly read or understand the data content.

[0146] Encrypted transmission: Encrypted transmission is a security measure that uses encryption algorithms to convert data into ciphertext that can only be interpreted by authorized users to protect the privacy and integrity of data during transmission over the network. In this way, unauthorized third parties can be prevented from intercepting and reading data content.

[0147] Password authentication: Password authentication is a common security mechanism used to verify user identity. In this authentication process, users must provide a secret sequence of characters, i.e. a password, to prove that they have the right to access a system or service. This method is based on the assumption that only legitimate users know the correct password.

[0148] Public key authentication: Public key authentication is an authentication mechanism based on asymmetric encryption that uses a pair of keys - a public key and a private key. In this mechanism, the public key can be safely shared publicly, while the private key must be kept secret and only known to the owner.

[0149] Brute-force attack: is a method of decryption and password guessing in which the attacker tries a large number of possibilities to crack a password, encryption key or other security mechanism. This attack does not rely on vulnerabilities or design flaws, but simply tries all possible combinations until the correct answer is found.

[0150] Open Secure Shell (OpenSSH): is a collection of free tools for encrypted network communications that implements the SSH protocol and provides secure remote login, file transfer, and network services. OpenSSH is a free and open source implementation of the SSH protocol and is widely used in various operating systems, including Linux, macOS, and Windows.

[0151] Firewall: A network security system that monitors and controls the flow of packets in and out of a computer network or system. Firewalls can be deployed as hardware, software, or a combination of both. Its main purpose is to create a barrier to protect internal networks from unauthorized access from external networks such as the Internet.

[0152] The following uses the SSH protocol as an example to illustrate the encrypted transmission process in the related technology.

[0153] Figure 1 A schematic diagram of a scenario of encrypted transmission based on the SSH protocol provided in an embodiment of the present application. Figure 1 As shown, Secure Shell (SSH) is a network security protocol that can implement secure access and file transfer services through encryption and authentication mechanisms to prevent data packet capture software (such as a sniffer) running on a second computing device from intercepting and reading data content.

[0154] SSH supports multiple authentication methods, including password authentication and public key authentication. Among them, password authentication is widely used because it is easy to use and does not require additional configuration.

[0155] In order to improve the security of password authentication, in the related art, the first computing device can set the maximum number of attempts M (such as MaxAuthTries M) in the configuration file (such as the MaxAuthTries configuration item of the configuration file). It should be noted that M is a positive integer greater than or equal to 1, and illustratively, M can be 3. However, the second terminal device can obtain the password by brute force, resulting in the problem of low security in the method in the related art.

[0156] Based on the above technical problems, an embodiment of the present application provides a communication security detection method, which can obtain authentication behavior data corresponding to the second computing device during the authentication process between the first computing device and the second computing device; in the identity authentication stage of the authentication process, obtain the identity authentication request sent by the second computing device, and determine the authentication behavior to which the identity authentication request belongs based on the authentication behavior data corresponding to the second computing device. If it is an abnormal behavior, the connection between the first computing device and the second computing device is disconnected.

[0157] Through the above method, the detection accuracy of abnormal behavior is improved, thereby improving the detection accuracy of communication security.

[0158] The following is a detailed description of the communication security detection method of the embodiment of the present application.

[0159] Figure 2 A schematic diagram of a communication security detection method provided in an embodiment of the present application. Figure 2 As shown, the scenario includes a first computing device 10 and a second computing device 20 .

[0160] The first computing device 10 may be a terminal device, a server, or a server cluster.

[0161] When the first computing device 10 is a server, from an architectural point of view, the server can be a rack server, a high-density server, a tower server or a whole cabinet server; from a functional point of view, the server can be a general-purpose server or an artificial intelligence server (AI (artificial intelligence) server), etc. For example, the artificial intelligence server can be a graphics processing server (GPU (graphics processing unit) server).

[0162] When the first computing device 10 is a terminal device, the terminal device may be, but is not limited to, various personal computers, laptops, smart phones, and tablet computers.

[0163] The second computing device 20 may be a terminal device, a server, or a server cluster, which is not limited in this embodiment of the present application.

[0164] The first computing device 10 may run a server (software), and the second computing device 20 may run a client (software).

[0165] exist Figure 2 In the scenario shown, during the authentication process between the first computing device 10 and the second computing device 20, authentication behavior data corresponding to the second computing device 20 is obtained.

[0166] During the identity authentication stage of the authentication process, the first computing device 10 may obtain an identity authentication request sent by the second computing device 20 .

[0167] The first computing device 10 can determine whether the authentication behavior to which the identity authentication request belongs is an abnormal behavior based on the authentication behavior data corresponding to the second computing device 20.

[0168] If so, the first computing device 10 may disconnect the first computing device 10 from the second computing device 20 .

[0169] It should be noted that Figure 2 This is a schematic diagram of the scenario provided by the embodiment of the present application. The embodiment of the present application is not Figure 2 The actual form of the various devices included in the Figure 2 The interaction mode between devices is limited, and in the application of the solution, it can be set according to actual needs.

[0170] The technical solution of the present application is described in detail below through specific embodiments. It should be noted that the following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0171] Figure 3a A flowchart of a communication security detection method embodiment 1 provided in the present application. Figure 3a , the method specifically comprises the following steps:

[0172] S301: During the authentication process between the first computing device and the second computing device, obtaining authentication behavior data corresponding to the second computing device.

[0173] Figure 3b A flowchart of an authentication process provided in an embodiment of the present application. Figure 3c A schematic diagram of obtaining authentication behavior data provided in an embodiment of the present application.

[0174] First, combine Figure 3b and Figure 3c, the process of the first computing device obtaining the authentication behavior data corresponding to the second computing device during the authentication process between the first computing device and the second computing device is described. It should be noted that the method of the embodiment of the present application can be applied to the SSH authentication process and can also be applied to the authentication process of other protocols, and the embodiment of the present application is not limited to this.

[0175] like Figure 3b As shown, the authentication process includes a connection establishment phase, a version number negotiation phase, an encryption algorithm negotiation phase, a key negotiation phase, and an identity authentication phase.

[0176] During the connection establishment phase of the authentication process:

[0177] (1) The first computing device can establish a TCP connection with the second computing device. Specifically, the first computing device can listen for connection requests. The second computing device can send a connection request (first handshake message) to the first computing device. The connection request can include the device identification of the second computing device. After obtaining the first handshake message, the first computing device can reply with a second handshake message. The second computing device can send a third handshake message to the first computing device. In the above manner, the first computing device establishes a TCP connection with the second computing device.

[0178] During the connection establishment phase of the authentication process, the first computing device may obtain authentication behavior data corresponding to the second computing device, where the authentication behavior data may include:

[0179] Device identification; wherein the device identification may be an Internet Protocol (IP) address of the second computing device, and the device identification may be an IP address and a port number of the second computing device;

[0180] Connection initiation time (T start ). It should be noted that the connection initiation time is the time when the first computing device receives the connection request.

[0181] During the version number negotiation phase of the authentication process:

[0182] (2) The first computing device may send a first message to the second computing device, wherein the first message includes a version number (eg, an SSH version number) supported by the first computing device.

[0183] (3) The second computing device may determine a version number to be used in response to the first message. The version number to be used may be the same as a version number supported by the first computing device, or may be a version number compatible with the version number supported by the first computing device. The second computing device may send a first response message to the first computing device, wherein the first response message includes the version number to be used.

[0184] (4) The first computing device may determine whether it supports the version number used by the second computing device. If not, the connection between the first computing device and the second computing device is disconnected. If so, the version number negotiation result is determined (indicating that the version number negotiation is successful), and a second message is sent to the second computing device. The second message includes the version number negotiation result. After sending the second message to the second computing device, the first computing device may enter the encryption algorithm negotiation phase.

[0185] During the version number negotiation phase of the authentication process, the first computing device may obtain authentication behavior data corresponding to the second computing device, where the authentication behavior data may include:

[0186] Use version numbers;

[0187] The response time of the first response message (T versionA ); wherein the response duration of the first response message is the duration between the moment when the first computing device sends the first message to the second computing device and the moment when the first computing device receives the first response message;

[0188] The amount of data in the first response message (Byte versionA ).

[0189] During the encryption algorithm negotiation phase of the authentication process:

[0190] (5) After obtaining the second message sent by the first computing device, the second computing device may send a second response message (e.g., SSH_MSG_KEXINIT) to the first computing device. The second response message includes an algorithm supported by the second computing device. The algorithms supported by the second computing device include at least one or more of the following: a key exchange algorithm, a host key algorithm, a symmetric encryption algorithm, a message authentication algorithm, and a compression algorithm.

[0191] (6) The first computing device may send a third message (eg, SSH_MSG_KEXINIT) to the second computing device, wherein the third message includes an algorithm supported by the first computing device.

[0192] Both the second computing device and the first computing device can determine the algorithm to be used (the algorithm obtained after negotiation) according to the algorithm supported by the local end and the algorithm supported by the other end.

[0193] During the encryption algorithm negotiation phase of the authentication process, the first computing device may obtain authentication behavior data corresponding to the second computing device, where the authentication behavior data may include:

[0194] Use algorithms;

[0195] The response time of the second response message (T kexinitA); wherein the response duration of the second response message is the duration between the moment when the first computing device sends the second message to the second computing device and the moment when the first computing device receives the second response message;

[0196] The amount of data in the second response message (Byte kexinitA ).

[0197] During the key negotiation phase of the authentication process:

[0198] (7) The second computing device may send a third response message (e.g., SSH_MSG_KEXDH_INIT) to the first computing device. In one implementation, the second computing device may generate a temporary key pair and calculate the public key of the second computing device after obtaining the third message. The second computing device may generate a third response message, wherein the third response message includes the public key of the second computing device.

[0199] (8) The first computing device may send a fourth message (e.g., SSH_MSG_KEXDH_REPLY) to the second computing device. In one implementation, after obtaining the third response message, the first computing device generates a temporary key pair and calculates the public key of the first computing device. The first computing device calculates a shared key based on the public key of the second computing device and the private key of the first computing device. The first computing device generates a signature of the first computing device based on the public key of the first computing device, the private key of the first computing device, and the shared key, and encapsulates the signature of the first computing device into the fourth message.

[0200] (9) After sending the fourth message, the first computing device may send a fifth message (eg, SSH_MSG_NEWKEYS) to the second computing device, wherein the fifth message is used to indicate that the first computing device can use the shared key for communication.

[0201] (10) After obtaining the fourth message sent by the first computing device, the second computing device may send a fourth response message (e.g., SSH_MSG_NEWKEYS) to the first computing device. In one implementation, after obtaining the fourth message sent by the first computing device, the second computing device may use the public key of the first computing device and the private key of the second computing device to calculate the shared key. After verifying the signature of the first computing device, the second computing device may send a fourth response message (e.g., SSH_MSG_NEWKEYS) to the first computing device. The fourth response message is used to indicate that the second computing device can use the shared key for communication.

[0202] During the key negotiation phase of the authentication process, the first computing device may obtain authentication behavior data corresponding to the second computing device, where the authentication behavior data may include:

[0203] The response time of the third response message (T kexdh1A ); wherein the response duration of the third response message is the duration between the moment when the first computing device sends the third message (for example, SSH_MSG_KEXINIT) to the second computing device and the moment when the first computing device receives the third response message (for example, SSH_MSG_KEXDH_INIT);

[0204] The response time of the fourth response message (T kexdh2A ); wherein the response duration of the fourth response message is the duration between the moment when the first computing device sends the fourth message (for example, SSH_MSG_KEXDH_REPLY) to the second computing device and the moment when the first computing device receives the fourth response message (for example, SSH_MSG_NEWKEYS);

[0205] The data volume of the third response message and the fourth response message (Byte kexdhA ); wherein the data volume of the third response message and the fourth response message is the sum of the data volume of the third response message and the data volume of the fourth response message.

[0206] During the identity verification phase of the authentication process:

[0207] (11) The second computing device may send a fifth response message—an identity authentication request—to the first computing device, wherein the identity authentication request includes a password.

[0208] (12) The first computing device may perform authentication processing on the authentication request (e.g., SSH2_MSG_USERAUTH_REQUEST) to obtain an authentication result. If the authentication result indicates that the authentication fails, the first computing device may encapsulate the authentication result into authentication failure information (e.g., SSH2_MSG_USERAUTH_FAILURE) and send the authentication failure information to the second computing device.

[0209] (13) The second computing device may send a retry response message, a new authentication request (eg, SSH2_MSG_USERAUTH_REQUEST), to the first computing device based on the authentication failure information, wherein the new authentication request includes a new password.

[0210] (14) The first computing device may perform identity authentication processing on the new identity authentication request and obtain a new identity authentication result. If the new identity authentication result indicates that the authentication is successful, the first computing device may encapsulate the identity authentication result into identity authentication success information (e.g., SSH2_MSG_USERAUTH_SUCCESS) and send the identity authentication success information to the second computing device.

[0211] During the identity authentication phase of the authentication process, the first computing device may obtain authentication behavior data corresponding to the second computing device, where the authentication behavior data may include:

[0212] The response time of the fifth response message (T auth1A ); wherein the response duration of the fifth response message is the duration between the moment when the first computing device sends the fifth message (for example, SSH_MSG_NEWKEYS) to the second computing device and the moment when the first computing device receives the fifth response message (for example, SSH2_MSG_USERAUTH_REQUEST);

[0213] In addition, when the first identity authentication fails, the first computing device may record the response time (T auth2nA ); wherein the response duration of the retry response message is the duration between the moment when the first computing device sends the authentication failure information (e.g., SSH2_MSG_USERAUTH_FAILURE) to the second computing device and the moment when the first computing device receives a new authentication request (e.g., SSH2_MSG_USERAUTH_REQUEST).

[0214] It should be noted that n refers to the nth time that the second computing device sends a new identity authentication request, that is, n refers to the nth time that the second computing device retry the password.

[0215] It can be understood that when the computing device sends a new identity authentication request for the nth time, the second computing device sends an identity authentication request for n+1 times.

[0216] Based on the above content, the authentication behavior data table (Table 1) can be obtained.

[0217] Table 1 Authentication behavior data table

[0218]

[0219]

[0220] S302: During the identity authentication phase of the authentication process, an identity authentication request sent by the second computing device is obtained.

[0221] In this embodiment, during the identity authentication phase of the authentication process, the first computing device may obtain an identity authentication request sent by the second computing device. Wherein, if password authentication is supported during the identity authentication phase, the identity authentication request may include a password for verifying the identity of the second computing device.

[0222] It should be noted that, in one implementation, the identity authentication request is sent by the second computing device in response to the fifth message (eg, SSH_MSG_NEWKEYS) sent by the first computing device.

[0223] In one implementation, the identity authentication request is sent by the second computing device in response to identity authentication failure information (eg, SSH2_MSG_USERAUTH_FAILURE) sent by the first computing device.

[0224] S303: Determine, based on the authentication behavior data corresponding to the second computing device, whether the authentication behavior to which the identity authentication request belongs is an abnormal behavior.

[0225] In this embodiment, during one authentication process, all actions of the second computing device are authentication actions.

[0226] During the authentication process, the data corresponding to the authentication behavior is the authentication behavior data.

[0227] The authentication behavior data may include at least one of the following:

[0228] Equipment identification;

[0229] Device configuration information;

[0230] The response duration of at least one response message.

[0231] In one implementation, the authentication behavior data may also include the connection initiation time.

[0232] It should be noted that the response time of at least one response message may include at least one of the following: the response time of the first response message, the response time of the second response message, the response time of the third response message, the response time of the fourth response message, the response time of the fifth response message, and the response time of the retry response message (at least one retry response time). It should also be noted that the response time of at least one response message may reflect the network distance between the first computing device and the second computing device, and the computing time of the second computing device.

[0233] It should be noted that the device configuration information may include the usage version number, the usage algorithm, and the data volume of at least one response message. It should be noted that the data volume of at least one response message may include at least one of the following: the data volume of the first response message, the data volume of the second response message, the data volume of the third response message, and the data volume of the fourth response message (the sum of the data volume of the third response message and the data volume of the fourth response message). It should also be noted that the data volume of at least one response message is related to the configuration of the second computing device. It should also be noted that the device configuration information of different computing devices may be the same or different.

[0234] When obtaining the identity authentication request, the first computing device may determine whether the authentication behavior to which the identity authentication request belongs is an abnormal behavior based on the authentication behavior data corresponding to the second computing device.

[0235] If yes, execute S304.

[0236] If not, execute S305.

[0237] The following describes a process in which the first computing device determines whether the authentication behavior to which the identity authentication request belongs is an abnormal behavior based on the authentication behavior data corresponding to the second computing device.

[0238] In one implementation:

[0239] The first computing device may query a historical anomaly database to obtain historical anomaly data.

[0240] The first computing device may determine whether the historical anomaly data matches the authentication behavior data.

[0241] If so, the first computing device may determine that the authentication behavior is abnormal behavior.

[0242] If not, the first computing device may determine whether the authentication behavior is abnormal behavior based on the identity authentication result. It should be noted that the identity authentication result is obtained by the first computing device performing identity authentication processing on the identity authentication request. The identity authentication result may indicate that the authentication is successful or that the authentication fails.

[0243] The following describes the reason why the first computing device can determine that the authentication behavior is an abnormal behavior when it is determined that the historical abnormal data matches the authentication behavior data.

[0244] If the second computing device is a device that brute-force cracks the password by continuous attempts, the device configuration information of the second computing device and the response time of the response message (the response time is affected by the network distance between the first computing device and the second computing device and the computing time of the second computing device) remain unchanged. In addition, if the second computing device does not change its IP address, the IP address of the second computing device remains unchanged.

[0245] That is to say, the authentication behavior data of the authentication behavior of the second computing device remains unchanged. Therefore, when the first computing device determines that the historical abnormal data matches the authentication behavior data (including at least one of the following: device identification, device configuration information, and the response time of at least one response message), it can determine that the computing device corresponding to the historical abnormal data is the same device as the second computing device. Since the historical abnormal data is data corresponding to the abnormal behavior, the authentication behavior of the second computing device is abnormal behavior accordingly.

[0246] S304: Disconnect the connection between the first computing device and the second computing device.

[0247] In this embodiment, the first computing device may disconnect the first computing device from the second computing device if it is determined that the authentication behavior is an abnormal behavior.

[0248] S305: Send the identity authentication result to the second computing device.

[0249] In this embodiment, the first computing device may send an identity authentication result to the second computing device when determining that the authentication behavior is not an abnormal behavior, wherein the identity authentication result indicates that the authentication is successful, or the identity authentication result indicates that the authentication is failed.

[0250] It should be noted that the identity authentication result is obtained by the first computing device performing identity authentication processing on the identity authentication request.

[0251] It should also be noted that the first computing device may first determine whether the authentication behavior is an abnormal behavior based on the authentication behavior data, and then determine the identity authentication result. The first computing device may also first determine the identity authentication result, and then determine whether the authentication behavior is an abnormal behavior based on the authentication behavior data. The first computing device may also determine whether the authentication behavior is an abnormal behavior based on the authentication behavior data while determining the identity authentication result. The embodiments of the present application are not limited to this.

[0252] Next, the process of the first computing device performing identity authentication processing on the identity authentication request is described.

[0253] In one implementation, the first computing device may determine whether the password in the authentication request is consistent with the password stored in the first computing device. If so, the first computing device may determine that the authentication result indicates that the authentication is successful; if not, the first computing device may determine that the authentication result indicates that the authentication is unsuccessful.

[0254] It should be noted that, when the identity authentication result indicates that the authentication is successful, the first computing device may encapsulate the identity authentication result into identity authentication success information (eg, SSH2_MSG_USERAUTH_SUCCESS), and send the identity authentication success information to the second computing device.

[0255] When the identity authentication result indicates that the authentication has failed, the first computing device may encapsulate the identity authentication result into identity authentication failure information (eg, SSH2_MSG_USERAUTH_FAILURE), and send the identity authentication failure information to the second computing device.

[0256] Beneficial effects of this embodiment: In this embodiment, the first computing device can obtain the authentication behavior data corresponding to the second computing device during the authentication process between the first computing device and the second computing device. The first computing device can obtain the authentication request sent by the second computing device during the authentication stage of the authentication process. The first computing device can disconnect the connection between the first computing device and the second computing device when it is determined that the authentication behavior to which the authentication request belongs is an abnormal behavior based on the authentication behavior data corresponding to the second computing device, so as to prevent the second computing device from using continuous attempts to brute force the password. The method of the embodiment of the present application improves the detection accuracy of communication security and improves the security of authentication. In addition, compared with the related art, it takes a long time to configure the firewall to prevent the computing device to which the malicious IP address belongs from being authenticated, and there may be a situation where the computing device switches the IP address to bypass the firewall, resulting in a low detection accuracy of communication security. The method of the embodiment of the present application can use the authentication behavior data reflecting the authentication behavior of the second computing device to determine whether the authentication behavior is an abnormal behavior, thereby improving the detection accuracy of abnormal behavior, thereby improving the detection accuracy of communication security and improving the security of authentication.

[0257] Figure 4 A flow chart of a second embodiment of a communication security detection method provided in an embodiment of the present application. Figure 4 , the method specifically comprises the following steps:

[0258] S401: During the authentication process between the first computing device and the second computing device, obtaining authentication behavior data corresponding to the second computing device.

[0259] In this embodiment, during the authentication process between the first computing device and the second computing device, the first computing device may obtain authentication behavior data corresponding to the second computing device.

[0260] The specific implementation process is the same as S301 and will not be repeated here.

[0261] S402: During the identity authentication phase of the authentication process, an identity authentication request sent by the second computing device is obtained.

[0262] In this embodiment, during the identity authentication stage of the authentication process, the first computing device may obtain an identity authentication request sent by the second computing device.

[0263] The identity authentication request may include a password.

[0264] S403: Query the historical anomaly database to obtain historical anomaly data.

[0265] In this embodiment, at least one historical abnormal data is stored in the historical abnormal database (also referred to as an abnormal behavior record library).

[0266] The first computing device may query the historical anomaly database to obtain the historical anomaly data. It should be noted that, in one implementation, the first computing device may run the historical anomaly database. The first computing device may directly query the historical anomaly database to obtain the historical anomaly data. In one implementation, other computing devices in the computing device cluster may run the historical anomaly data, and the first computing device may query the historical anomaly database to obtain the historical anomaly data by communicating with other computing devices.

[0267] In one implementation, the first computing device may obtain all historical anomaly data in the historical anomaly database. It should be noted that, in one implementation, each historical anomaly data may include the time at which the historical connection was initiated, and the first computing device may delete the target historical anomaly data at regular intervals. The target historical anomaly data is the time interval between the time at which the historical connection was initiated and the current time, which is greater than the first preset time interval.

[0268] In one implementation, each historical abnormal data may include a historical connection initiation time, and the authentication behavior data may include a connection initiation time. The first computing device may obtain historical abnormal data in the historical abnormality database, where the time interval between the historical connection initiation time and the connection initiation time is less than a second preset time interval.

[0269] Next, the process of establishing the historical anomaly database by the first computing device is described by taking the operation of the historical anomaly database by the first computing device as an example.

[0270] For any historical computing device, the first computing device can obtain the authentication behavior data corresponding to the historical computing device during the authentication process between the first computing device and the historical computing device. In the identity authentication stage, the first computing device can obtain the identity authentication request sent by the historical computing device. The first computing device can add 1 to the number of failures to obtain an updated number of failures when the identity authentication result corresponding to the identity authentication request indicates that the authentication failed. In addition, the first computing device can also supplement the authentication behavior data according to the response time of the identity authentication request when the identity authentication result corresponding to the identity authentication request indicates that the authentication failed, and obtain the supplemented authentication behavior data. The first computing device can determine whether the updated number of failures reaches the preset number. The first computing device can store the supplemented authentication behavior data as historical abnormality data in the historical abnormality database when it is determined that the updated number of failures reaches the preset number.

[0271] It should be noted that the historical computing device and the second computing device may be the same computing device or different computing devices.

[0272] S404: Determine whether the historical abnormal data matches the authentication behavior data.

[0273] In this embodiment, after acquiring the historical abnormal data, the first computing device may determine whether the historical abnormal data matches the authentication behavior data.

[0274] If yes, execute S405.

[0275] If not, execute S406;

[0276] It should be noted that, in one implementation, when the first computing device obtains multiple historical abnormal data, the first computing device may determine whether at least one of the multiple historical abnormal data matches the authentication behavior data. If so, execute S405; if not, execute S406.

[0277] Next, the process of the first computing device determining whether the historical abnormal data matches the authentication behavior data is described.

[0278] In one implementation:

[0279] In the case where the authentication behavior data includes a device identification, the first computing device may determine whether the historical device identification in the historical abnormal data is consistent with the device identification.

[0280] If so, the first computing device may determine that the historical anomaly data matches the authentication behavior data.

[0281] If not, the first computing device may determine that the historical anomaly data does not match the authentication behavior data.

[0282] In one implementation:

[0283] In the case where the authentication behavior data includes device configuration information, the first computing device may determine whether multiple conditions are satisfied respectively, wherein the device configuration information includes a usage version number, a usage algorithm, and a data volume of at least one response message.

[0284] If so, the first computing device may determine that the historical anomaly data matches the authentication behavior data.

[0285] If not, the first computing device may determine that the historical anomaly data does not match the authentication behavior data.

[0286] Among them, several conditions include:

[0287] The historical usage version number in the historical abnormal data is consistent with the usage version number;

[0288] The data volume of at least one historical response message in the historical abnormal data is consistent with the data volume of at least one response message;

[0289] The historical usage algorithm in the historical anomaly data is consistent with the usage algorithm.

[0290] In one implementation:

[0291] When the authentication behavior data includes the response time of at least one response message, for any response message, the first computing device can calculate the time difference rate corresponding to the response message based on the response time of the response message and the response time of historical response messages in the historical exception data; the response message corresponds to the historical response message.

[0292] The first calculation device may calculate an average duration difference rate according to a duration difference rate corresponding to at least one response message, and may calculate a matching coefficient according to the average duration difference rate.

[0293] The first computing device may determine whether the matching coefficient reaches a preset threshold.

[0294] If so, the first computing device may determine that the historical anomaly data matches the authentication behavior data.

[0295] If not, the first computing device may determine that the historical anomaly data does not match the authentication behavior data.

[0296] In one implementation:

[0297] In the case where the authentication behavior data includes a device identification, device configuration information, and a response duration of at least one response message, the first computing device may determine whether a historical device identification in the historical abnormal data is consistent with the device identification.

[0298] If so, the first computing device may determine that the historical anomaly data matches the authentication behavior data.

[0299] If not, the first computing device can determine whether multiple conditions are met respectively. If not, it is determined that the historical abnormal data does not match the authentication behavior data; if so, for any response message, the first computing device can calculate the duration difference rate corresponding to the response message based on the response duration of the response message and the response duration of the historical response message in the historical abnormal data; the response message corresponds to the historical response message. The first computing device can calculate the average duration difference rate based on the duration difference rate corresponding to at least one response message. The first computing device can calculate the matching coefficient based on the average duration difference rate. The first computing device can determine that the historical abnormal data matches the authentication behavior data when it is determined that the matching coefficient reaches a preset threshold.

[0300] In one implementation:

[0301] In the case where the authentication behavior data includes a device identification, device configuration information, and a response duration of at least one response message, the first computing device may determine whether a historical device identification in the historical abnormal data is consistent with the device identification.

[0302] If so, the first computing device may determine that the historical anomaly data matches the authentication behavior data.

[0303] If not, for any response message, the first computing device may calculate the duration difference rate corresponding to the response message according to the response duration of the response message and the response duration of the historical response message in the historical abnormal data; the response message corresponds to the historical response message. The first computing device may calculate the average duration difference rate according to the duration difference rate corresponding to at least one response message. The first computing device may calculate the matching coefficient according to the average duration difference rate.

[0304] The first computing device may determine whether the matching coefficient reaches a preset threshold.

[0305] If not, the first computing device may determine that the historical anomaly data does not match the authentication behavior data.

[0306] If yes, the first computing device may determine whether the multiple conditions are satisfied respectively. If yes, it is determined that the historical abnormal data matches the authentication behavior data; if no, the first computing device may determine that the historical abnormal data does not match the authentication behavior data.

[0307] S405: Determine that the authentication behavior is an abnormal behavior.

[0308] In this embodiment, the first computing device may determine that the authentication behavior is an abnormal behavior when it is determined that the historical abnormal data matches the authentication behavior data.

[0309] The first computing device may execute S407 after executing S405.

[0310] S406: Determine whether the authentication behavior is abnormal behavior based on the identity authentication result.

[0311] In this embodiment, when it is determined that the historical abnormal data does not match the authentication behavior data, the first computing device may determine whether the authentication behavior is an abnormal behavior based on the identity authentication result.

[0312] If yes, execute S407.

[0313] If not, execute S408.

[0314] Next, a process of determining whether the authentication behavior is an abnormal behavior according to the identity authentication result by the first computing device is described.

[0315] In one implementation:

[0316] When the identity authentication result indicates that the authentication has failed, the first computing device may add 1 to the number of failures to obtain an updated number of failures.

[0317] The first computing device may determine whether the number of failures after updating reaches a preset number.

[0318] If so, the first computing device can determine that the authentication behavior is abnormal. That is, the first computing device can determine that the second computing device is a computing device that brute-forces password cracking when the number of failures after the update reaches a preset number, and the first computing device can determine that the authentication behavior of the second computing device is abnormal.

[0319] If not, the first computing device may determine that the authentication behavior is not abnormal behavior.

[0320] S407: Disconnect the connection between the first computing device and the second computing device.

[0321] In this embodiment, the first computing device may disconnect the first computing device from the second computing device if it is determined that the authentication behavior is an abnormal behavior.

[0322] S408: Send the identity authentication result to the second computing device.

[0323] In this embodiment, the first computing device may send an identity authentication result to the second computing device when determining that the authentication behavior is not an abnormal behavior, wherein the identity authentication result indicates that the authentication is successful, or the identity authentication result indicates that the authentication is failed.

[0324] Beneficial effects of this embodiment: In this embodiment, the first computing device can perform identity authentication processing on the identity authentication request after obtaining the identity authentication request to obtain the identity authentication result. The first computing device can determine that the second computing device is a device that brute-force cracks the password by re-establishing a connection to reopen the SSH authentication process when it is determined that the historical abnormal data matches the authentication behavior data. The first computing device can determine that the authentication behavior is an abnormal behavior and disconnect the first computing device from the second computing device. The first computing device can disconnect the first computing device from the second computing device when it is determined that the historical abnormal data does not match the authentication behavior data and when it is determined that the authentication behavior is an abnormal behavior based on the identity authentication result. By combining the above-mentioned method of using the authentication behavior data to determine whether the authentication behavior is an abnormal behavior with the identity authentication result to determine whether the authentication behavior is an abnormal behavior, the detection accuracy of abnormal behavior is improved, thereby improving the detection accuracy of communication security.

[0325] Figure 5 This is a flow chart of a third embodiment of a communication security detection method provided in an embodiment of the present application. Figure 5 , the method specifically comprises the following steps:

[0326] S501: During the authentication process between the first computing device and the second computing device, obtaining authentication behavior data corresponding to the second computing device.

[0327] In this embodiment, during the authentication process between the first computing device and the second computing device, the first computing device may obtain authentication behavior data corresponding to the second computing device.

[0328] The specific implementation process is the same as S301 and will not be repeated here.

[0329] S502: During the identity authentication phase of the authentication process, an identity authentication request sent by the second computing device is obtained.

[0330] In this embodiment, during the identity authentication stage of the authentication process, the first computing device may obtain an identity authentication request sent by the second computing device.

[0331] The identity authentication request may include a password for verifying the identity of the second computing device.

[0332] S503: Query the historical anomaly database to obtain historical anomaly data.

[0333] In this embodiment, the first computing device may query a historical anomaly database to obtain historical anomaly data.

[0334] S504: Determine whether the historical abnormal data matches the authentication behavior data.

[0335] In this embodiment, the first computing device may obtain historical abnormal data.

[0336] The first computing device may determine whether the historical anomaly data matches the authentication behavior data.

[0337] If yes, execute S505.

[0338] If not, execute S506;

[0339] S505: Determine that the authentication behavior is an abnormal behavior.

[0340] In this embodiment, the first computing device may determine that the authentication behavior is an abnormal behavior when it is determined that the historical abnormal data matches the authentication behavior data.

[0341] The first computing device may execute S510 after executing S505 .

[0342] S506: When the identity authentication result indicates that the authentication has failed, the number of failures is incremented by 1 to obtain an updated number of failures.

[0343] In this embodiment, the first computing device may determine whether the identity authentication result indicates an authentication failure when it is determined that the historical abnormal data does not match the authentication behavior data.

[0344] When the identity authentication result indicates that the authentication has failed, the first computing device may add 1 to the number of failures to obtain an updated number of failures.

[0345] S507: Determine whether the number of failures after updating reaches a preset number.

[0346] In this embodiment, the first computing device may determine whether the number of failures after updating reaches a preset number.

[0347] If yes, execute S508;

[0348] If not, execute S511.

[0349] S508: Determine that the authentication behavior is an abnormal behavior.

[0350] In this embodiment, the first computing device may determine that the authentication behavior is an abnormal behavior when the number of failures after determining the update reaches a preset number.

[0351] S509: The supplemented authentication behavior data is used as historical abnormality data and stored in the historical abnormality database.

[0352] In this embodiment, when the first computing device determines that the number of failures after updating reaches a preset number, it can also store the supplemented authentication behavior data as historical abnormality data in the historical abnormality database.

[0353] It should be noted that the supplemented authentication behavior data is obtained by the first computing device performing supplementary processing on the authentication behavior data according to the response time of the identity authentication request when the identity authentication result indicates that the authentication has failed.

[0354] Next, a process in which the first computing device supplements the authentication behavior data according to the response duration of the identity authentication request to obtain the supplemented authentication behavior data is described.

[0355] The first computing device may obtain the response time of the identity authentication request.

[0356] In one implementation, in the case where the identity authentication request is a response message (fifth response message) sent by the second computing device in response to receiving a fifth message (e.g., SSH_MSG_NEWKEYS) sent by the first computing device, the first computing device can determine the response duration of the identity authentication request based on the time when the first computing device sends the fifth message and the time when the first computing device receives the identity authentication request (fifth response message).

[0357] In one implementation, in the case where the identity authentication request is a retry response message sent by the second computing device in response to receiving the identity authentication failure information (e.g., SSH2_MSG_USERAUTH_FAILURE) sent by the first computing device, the first computing device can determine the response duration of the identity authentication request based on the time when the first computing device sends the identity authentication failure and the time when the first computing device receives the identity authentication request (retry response message).

[0358] The first computing device may obtain the response time of the identity authentication request, perform supplementary processing on the authentication behavior data, and obtain supplemented authentication behavior data.

[0359] Next, the reason why the first computing device stores the supplemented authentication behavior data as historical abnormality data in the historical abnormality database is explained.

[0360] In the new authentication process, the first computing device can query the historical anomaly database and obtain historical anomaly data (supplemented authentication behavior data) when obtaining a new identity authentication request sent by the second computing device. The first computing device can determine whether the historical anomaly data (supplemented authentication behavior data) matches the authentication behavior data corresponding to the second computing device (the data corresponding to the new authentication behavior in the new authentication process). If so, the first computing device can directly determine that the new authentication behavior (the authentication behavior to which the new authentication request belongs) is an abnormal behavior. The first computing device can disconnect the first computing device from the second computing device.

[0361] By adopting the above method, it is possible to avoid the second computing device from restarting the authentication process and performing identity authentication again to crack the password by brute force, thereby improving the detection accuracy of communication security and the security of the authentication process.

[0362] S510: Disconnect the connection between the first computing device and the second computing device.

[0363] In this embodiment, the first computing device may disconnect the first computing device from the second computing device if it is determined that the authentication behavior is an abnormal behavior.

[0364] It should be noted that the first computing device may execute S509 first and then S510, or may execute S510 first and then S509, or may execute S509 and S510 at the same time. The embodiment of the present application does not limit the execution order of S509 and S510.

[0365] S511: Determine that the authentication behavior is not an abnormal behavior.

[0366] In this embodiment, the first computing device may determine that the authentication behavior is not an abnormal behavior when the number of failures after the update does not reach a preset number.

[0367] S512: Determine the supplemented authentication behavior data as the authentication behavior data corresponding to the second computing device.

[0368] In this embodiment, the first computing device may also determine the supplemented authentication behavior data as the authentication behavior data corresponding to the second computing device when determining that the number of failures after update does not reach a preset number.

[0369] It should be noted that when the first computing device obtains a new identity authentication request sent by the second computing device, it can query the historical anomaly database to obtain historical anomaly data. The first computing device can determine whether the historical anomaly data matches the authentication behavior data (supplemented authentication behavior data) corresponding to the second computing device. If so, the first computing device can directly determine that the authentication behavior is an abnormal behavior. The first computing device can disconnect the first computing device from the second computing device.

[0370] It should also be noted that the supplemented authentication behavior data is obtained by supplementing the authentication behavior data according to the response time of the identity authentication request when the identity authentication result indicates that the authentication has failed.

[0371] S513: Send the identity authentication result to the second computing device.

[0372] In this embodiment, the first computing device may send an identity authentication result to the second computing device when the updated number of failures does not reach the preset number, wherein the identity authentication result indicates that the authentication is successful or the identity authentication result indicates that the authentication is failed.

[0373] It should be noted that the first computing device may execute S512 first and then S513, or may execute S513 first and then S512, or may execute S512 and S513 at the same time. The embodiment of the present application does not limit the execution order of S512 and S513.

[0374] Beneficial effects of this embodiment: When the identity authentication result indicates that the authentication failed, the first computing device can add 1 to the number of failures to obtain an updated number of failures. When the first computing device determines that the updated number of failures reaches a preset number, it can determine that the authentication behavior is an abnormal behavior and disconnect the first computing device from the second computing device. The first computing device can also store the supplemented authentication behavior data as historical abnormal data in the historical abnormality database. In the above manner, the historical abnormality database can be newly processed, so that when the second computing device restarts the authentication process to try to brute force the password, the new authentication behavior of the second computing device can be directly determined as abnormal behavior based on the historical abnormal data (supplemented authentication behavior data), thereby improving the detection accuracy and efficiency of communication security. In addition, when the second computing device determines that the updated number of failures does not reach the preset number, it can determine that the authentication behavior is not an abnormal behavior, and determine the supplemented authentication behavior data as the authentication behavior data corresponding to the second computing device. Through the above method, the authentication behavior data corresponding to the second computing device can truly and comprehensively reflect the authentication behavior of the second computing device. Then, when the second computing device sends a new identity authentication request, the first computing device can determine whether the authentication behavior is an abnormal behavior based on the authentication behavior data (supplemented authentication behavior data), thereby improving the detection accuracy of abnormal behavior and thus improving the detection accuracy of communication security.

[0375] Based on the technology of the second embodiment, the process of determining whether the historical abnormal data matches the authentication behavior data by the second computing device is described below through the fourth method embodiment. It can be understood that the fourth method embodiment is an explanation of an implementation of S404 of the second method embodiment.

[0376] Figure 6 A flowchart of a fourth embodiment of a communication security detection method provided in an embodiment of the present application. Figure 6 , the method specifically comprises the following steps:

[0377] S601: Determine whether the historical device identification in the historical abnormal data is consistent with the device identification.

[0378] In this embodiment, the authentication behavior data includes a device identification. It should be noted that the device identification is obtained during the connection establishment phase of the authentication process.

[0379] The first computing device may determine whether the historical device identification in the historical abnormal data is consistent with the device identification.

[0380] If yes, execute S602;

[0381] If not, execute S603.

[0382] S602: Determine whether the historical abnormal data matches the authentication behavior data.

[0383] In this embodiment, the first computing device may determine that the historical abnormal data matches the authentication behavior data when it is determined that the historical device identification in the historical abnormal data is consistent with the device identification.

[0384] S603: Determine whether multiple conditions are met respectively.

[0385] In this embodiment, the authentication behavior data includes device configuration information, wherein the device configuration information includes a usage version number, a usage algorithm, and a data volume of at least one response message.

[0386] The historical abnormal data includes historical device configuration information, wherein the historical device configuration information includes a historical usage version number, a historical usage algorithm, and a data volume of at least one historical response message.

[0387] It should be noted that the version number used is obtained during the version number negotiation phase of the authentication process.

[0388] The algorithm used is obtained during the encryption algorithm negotiation phase of the authentication process.

[0389] The data volume of at least one response message includes at least one of the following:

[0390] The amount of data in the first response message obtained during the version number negotiation phase of the authentication process;

[0391] The amount of data of the second response message obtained during the encryption algorithm negotiation phase of the authentication process;

[0392] The data volume of the third response message and the fourth response message obtained during the key negotiation phase of the authentication process.

[0393] The first computing device may determine whether a plurality of conditions are satisfied respectively when it is determined that the historical device identification in the historical abnormal data is inconsistent with the device identification.

[0394] Among them, several conditions include:

[0395] The historical version number negotiation result in the historical exception data is consistent with the version number negotiation result;

[0396] The data volume of at least one historical response message in the historical abnormal data is consistent with the data volume of at least one response message;

[0397] The historical algorithm negotiation results in the historical abnormal data are consistent with the algorithm negotiation results.

[0398] If not, execute S604;

[0399] If yes, execute S605.

[0400] S604: Determine that the historical abnormal data does not match the authentication behavior data.

[0401] In this embodiment, the first computing device may determine that the historical abnormal data does not match the authentication behavior data when it determines that at least one condition is not satisfied, that is, when it determines that the device configuration information in the authentication behavior data is inconsistent with the historical device configuration information in the historical abnormal data.

[0402] S605: For any response message, calculate the duration difference rate corresponding to the response message according to the response duration of the response message and the response durations of historical response messages in the historical abnormal data.

[0403] S606: Calculate an average duration difference rate according to the duration difference rate corresponding to at least one response message.

[0404] S607: Calculate a matching coefficient based on the average duration difference rate.

[0405] In this embodiment, the authentication behavior data includes a response duration of at least one response message.

[0406] The historical abnormal data includes at least one historical response time of a response message.

[0407] It should be noted that the response duration of at least one response message includes at least one of the following:

[0408] The response time of the first response message obtained during the version number negotiation phase of the authentication process;

[0409] The response duration of the second response message obtained during the encryption algorithm negotiation phase of the authentication process;

[0410] The response duration of the third response message and the response duration of the fourth response message obtained in the key negotiation phase of the authentication process;

[0411] The response time of the fifth response message obtained during the identity authentication phase of the authentication process;

[0412] The response duration of at least one retry response message obtained during the identity authentication phase of the authentication process.

[0413] When determining that multiple conditions are met respectively, the first computing device can calculate the duration difference rate corresponding to the response message according to the response duration of the response message and the response duration of the historical response message in the historical abnormal data for any response message, wherein the response message corresponds to the historical response message.

[0414] The first calculation device may calculate an average duration difference rate according to the duration difference rate corresponding to at least one response message.

[0415] The first computing device may calculate a matching coefficient according to the average duration difference rate.

[0416] Next, the process of calculating the matching coefficient by the first computing device is described.

[0417] The first computing device may calculate the matching coefficient using the following formula:

[0418]

[0419]

[0420] Wherein, P is the matching coefficient; N is the number of retry response messages sent by the first computing device (new identity authentication requests resent by the second computing device); T versionA T is the response time of the first response message; versionB is the response time of the first response message in history; A1 is the time difference rate corresponding to the first response message; T kexinitA T is the response time of the second response message; kexinitB is the response time of the second response message in history; A2 is the time difference rate corresponding to the second response message; T kexdh1A T is the response time of the third response message; kexdh1B is the response time of the third response message in history; A3 is the time difference rate corresponding to the third response message; T kexdh2A T is the response time of the fourth response message; kexdh2B is the response time of the fourth response message in history; A4 is the time difference rate corresponding to the fourth response message; T auth1A T is the response time of the fifth response message; auth1B is the response time of the fifth historical response message; A5 is the time difference rate corresponding to the fifth response message; T auth2nA T is the response time of the retry response message; auth2nB is the response time of the historical retry response message; A6 is the sum of the time difference rates corresponding to at least one retry response message.

[0421] S608: When it is determined that the matching coefficient reaches a preset threshold, it is determined that the historical abnormal data matches the authentication behavior data.

[0422] In this embodiment, the first computing device may determine whether the matching coefficient reaches a preset threshold after obtaining the matching coefficient. For example, the preset threshold may be 0.95.

[0423] If so, the first computing device may determine that the historical anomaly data matches the authentication behavior data.

[0424] Beneficial effects of this embodiment: In this embodiment, the first computing device can determine whether the historical abnormal data matches the authentication behavior data from the perspective of device identification, device configuration information (reflecting the actual configuration of the second computing device), and the response duration of at least one response message (reflecting the network distance between the first computing device and the second computing device, and the computing time of the second computing device). That is, it is determined whether the computing device corresponding to the historical abnormal data (abnormal computing device) is the same computing device as the second computing device corresponding to the authentication behavior data. If it is determined that the two are the same computing device, the authentication behavior of the second computing device is determined to be abnormal behavior, and the connection between the first computing device and the second computing device is disconnected, thereby improving the detection accuracy of abnormal behavior, thereby improving the detection accuracy of communication security, and thereby improving the security of authentication (such as SSH authentication).

[0425] The following is an embodiment of the device of the present application, which can be used to execute the embodiment of the method of the present application. For details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the method of the present application.

[0426] Figure 7 A schematic diagram of the structure of a communication security detection device provided in an embodiment of the present application. The communication security detection device 70 is applied to a first computing device.

[0427] like Figure 7 As shown, the communication security detection device 70 includes: a processing module 71 and an acquisition module 72. Among them,

[0428] Processing module 71, used for obtaining authentication behavior data corresponding to the second computing device during the authentication process between the first computing device and the second computing device;

[0429] An acquisition module 72, configured to acquire an identity authentication request sent by the second computing device during the identity authentication phase of the authentication process;

[0430] The processing module 71 is further used to determine whether the authentication behavior to which the identity authentication request belongs is an abnormal behavior according to the authentication behavior data corresponding to the second computing device;

[0431] The processing module 71 is further configured to disconnect the first computing device from the second computing device if yes.

[0432] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0433] In one implementation, the processing module 71 is specifically configured to:

[0434] Query the historical anomaly database to obtain historical anomaly data;

[0435] Determine whether historical abnormal data matches the authentication behavior data;

[0436] If so, the authentication behavior is determined to be abnormal behavior;

[0437] If not, determine whether the authentication behavior is an abnormal behavior based on the identity authentication result; wherein the identity authentication result is obtained by performing identity authentication processing on the identity authentication request.

[0438] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0439] In one implementation, the processing module 71 is specifically configured to:

[0440] If the identity authentication result indicates that the authentication failed, the number of failures is increased by 1 to obtain an updated number of failures;

[0441] Determine whether the number of failures after the update reaches a preset number;

[0442] If so, the authentication behavior is determined to be abnormal behavior.

[0443] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0444] In one implementation, the processing module 71 is further configured to:

[0445] The supplemented authentication behavior data is stored as historical abnormality data in a historical abnormality database; wherein the supplemented authentication behavior data is obtained by supplementing the authentication behavior data according to the response time of the identity authentication request when the identity authentication result indicates that the authentication has failed.

[0446] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0447] In one implementation, the processing module 71 is further configured to:

[0448] If not, the supplemented authentication behavior data will be determined as the authentication behavior data corresponding to the second computing device; wherein the supplemented authentication behavior data is obtained by supplementing the authentication behavior data according to the response time of the identity authentication request when the identity authentication result indicates that the authentication has failed.

[0449] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0450] In one implementation, the authentication behavior data includes a device identification;

[0451] The processing module 71 is specifically used for:

[0452] Determine whether the historical device identification in the historical abnormal data is consistent with the device identification;

[0453] If so, it is determined that the historical abnormal data matches the authentication behavior data.

[0454] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0455] In one implementation, the device identification is obtained during the connection establishment phase of the authentication process.

[0456] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0457] In one implementation, the authentication behavior data includes device configuration information, and the device configuration information includes a usage version number, a usage algorithm, and a data volume of at least one response message; the processing module 71 is further used to:

[0458] If not, determine whether multiple conditions are met respectively;

[0459] If not, it is determined that the historical abnormal data does not match the authentication behavior data;

[0460] Several conditions include:

[0461] The historical usage version number in the historical abnormal data is consistent with the usage version number;

[0462] The data volume of at least one historical response message in the historical abnormal data is consistent with the data volume of at least one response message;

[0463] The historical usage algorithm in the historical anomaly data is consistent with the usage algorithm.

[0464] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0465] In one implementation,

[0466] The version number used is obtained during the version number negotiation phase of the authentication process;

[0467] The algorithm used is obtained during the encryption algorithm negotiation phase of the authentication process;

[0468] The data volume of at least one response message includes at least one of the following: the data volume of a first response message obtained during the version number negotiation phase of the authentication process, the data volume of a second response message obtained during the encryption algorithm negotiation phase of the authentication process, and the data volume of a third response message and a fourth response message obtained during the key negotiation phase of the authentication process.

[0469] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0470] In one implementation, the authentication behavior data includes a response duration of at least one response message; the processing module 71 is further configured to:

[0471] If so, for any response message, the time difference rate corresponding to the response message is calculated according to the response time of the response message and the response time of the historical response messages in the historical abnormal data; the response message corresponds to the historical response message;

[0472] Calculate an average duration difference rate according to the duration difference rate corresponding to at least one response message;

[0473] According to the average duration difference rate, the matching coefficient is calculated;

[0474] When it is determined that the matching coefficient reaches a preset threshold, it is determined that the historical abnormal data matches the authentication behavior data.

[0475] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0476] In one implementation, the response duration of at least one response message includes at least one of the following:

[0477] The response time of the first response message obtained during the version number negotiation phase of the authentication process;

[0478] The response duration of the second response message obtained during the encryption algorithm negotiation phase of the authentication process;

[0479] The response duration of the third response message and the response duration of the fourth response message obtained in the key negotiation phase of the authentication process;

[0480] The response time of the fifth response message obtained during the identity authentication phase of the authentication process;

[0481] The response duration of at least one retry response message obtained during the identity authentication phase of the authentication process.

[0482] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0483] In one implementation, the device identification includes an Internet Protocol (IP) address of the second computing device.

[0484] The communication security detection device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0485] Figure 8 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. Figure 8 As shown, the computing device 80 includes: a processor 81 and a memory 82; wherein the processor 81 is coupled to the memory 82, and the memory 82 is used to store computer instructions; the processor 81 is used to execute computer instructions to enable the computing device 80 to execute the technical solution in the aforementioned method embodiment.

[0486] Optionally, the memory 82 may be independent or integrated with the processor 81. Optionally, when the memory 82 is a device independent of the processor 81, the first computing device 80 may further include: a bus 83 for connecting the above devices.

[0487] The processor is used to execute the technical solution in the aforementioned method embodiment, and its implementation principle and technical effect are similar and will not be repeated here.

[0488] An embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the technical solution provided by the aforementioned method embodiment.

[0489] An embodiment of the present application provides a computer program product, including a computer program, which is used to implement the technical solution provided by the aforementioned method embodiment when executed by a processor.

[0490] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: volatile memory, non-volatile memory and other media that can store program codes.

[0491] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A communication security detection method, characterized in that: Applied to a first computing device, the method includes: During the authentication process between the first computing device and the second computing device, obtaining authentication behavior data corresponding to the second computing device; During the identity authentication phase of the authentication process, obtaining an identity authentication request sent by the second computing device; Determining, according to the authentication behavior data corresponding to the second computing device, whether the authentication behavior to which the identity authentication request belongs is an abnormal behavior; If so, disconnect the first computing device from the second computing device.

2. The method according to claim 1, characterized in that The determining, according to the authentication behavior data corresponding to the second computing device, whether the authentication behavior to which the identity authentication request belongs is an abnormal behavior includes: Query the historical anomaly database to obtain historical anomaly data; Determining whether the historical abnormal data matches the authentication behavior data; If yes, then determining that the authentication behavior is abnormal behavior; If not, determine whether the authentication behavior is an abnormal behavior based on the identity authentication result; wherein the identity authentication result is obtained by performing identity authentication processing on the identity authentication request.

3. The method according to claim 2, characterized in that The determining, based on the identity authentication result, whether the authentication behavior is an abnormal behavior includes: If the identity authentication result indicates that the authentication failed, the number of failures is increased by 1 to obtain an updated number of failures; Determine whether the number of failures after the update reaches a preset number; If so, it is determined that the authentication behavior is an abnormal behavior.

4. The method according to claim 3, characterized in that The method further comprises: If not, the supplemented authentication behavior data will be determined as the authentication behavior data corresponding to the second computing device; wherein, the supplemented authentication behavior data is obtained by supplementing the authentication behavior data according to the response time of the identity authentication request when the identity authentication result indicates that the authentication has failed.

5. The method according to any one of claims 2 to 4, characterized in that: The authentication behavior data includes the device identification; The determining whether the historical abnormal data matches the authentication behavior data includes: Determine whether the historical device identification in the historical abnormal data is consistent with the device identification; If so, it is determined that the historical abnormal data matches the authentication behavior data.

6. The method according to claim 5, characterized in that The authentication behavior data includes the device configuration information, and the device configuration information includes a usage version number, a usage algorithm, and a data volume of at least one response message; the method further includes: If not, determine whether multiple conditions are met respectively; If not, determining that the historical abnormal data does not match the authentication behavior data; The multiple conditions include: The historical usage version number in the historical abnormal data is consistent with the usage version number; The data volume of at least one historical response message in the historical abnormal data is consistent with the data volume of the at least one response message; The historical usage algorithm in the historical abnormal data is consistent with the usage algorithm.

7. The method according to claim 6, characterized in that The usage version number is obtained during the version number negotiation phase of the authentication process; The algorithm used is obtained during the encryption algorithm negotiation phase of the authentication process; The data volume of the at least one response message includes at least one of the following: the data volume of the first response message obtained during the version number negotiation phase of the authentication process, the data volume of the second response message obtained during the encryption algorithm negotiation phase of the authentication process, and the data volume of the third response message and the fourth response message obtained during the key negotiation phase of the authentication process.

8. The method according to claim 6, characterized in that The authentication behavior data includes a response duration of the at least one response message; the method further includes: If yes, for any response message, the time difference rate corresponding to the response message is calculated according to the response time of the response message and the response time of the historical response messages in the historical abnormal data; the response message corresponds to the historical response message; Calculate an average duration difference rate according to the duration difference rate corresponding to at least one response message; Calculating a matching coefficient according to the average duration difference rate; When it is determined that the matching coefficient reaches a preset threshold, it is determined that the historical abnormal data matches the authentication behavior data.

9. The method according to claim 8, characterized in that The response duration of the at least one response message includes at least one of the following: The response duration of the first response message obtained during the version number negotiation phase of the authentication process; a response duration of a second response message obtained during the encryption algorithm negotiation phase of the authentication process; a response duration of a third response message and a response duration of a fourth response message obtained during a key negotiation phase of the authentication process; The response duration of the fifth response message obtained during the identity authentication phase of the authentication process; The response duration of at least one retry response message obtained during the identity authentication phase of the authentication process.

10. A computing device, characterized in that include: A processor, and a memory communicatively connected to the processor; The memory is used to store computer-executable instructions; The processor is used to execute the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 9.

Images