Library hit attack detection method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a library collision attack detection method and device, electronic equipment and a storage medium. The method comprises the following steps: acquiring multiple pieces of associated information and user login behavior data of a login network page in real time; conflict information is determined from the multiple pieces of associated information, and the total number of conflicts of the conflict information is counted within a preset duration; determining whether the conflict information is abnormal based on the total number of conflicts; and under the condition that the conflict information is determined to be abnormal, detecting whether the login network page is a library collision attack or not based on the user login behavior data. According to the technical scheme, the library collision attack can be automatically detected through the multiple pieces of associated information of the login network page and the login behavior data of the user, manual detection is not needed in the detection process, the problems of low efficiency and high error rate caused by manual detection of the library collision attack in the prior art are effectively solved, the account security of the user is guaranteed, and the user experience is improved. Therefore, immeasurable loss brought to the user is avoided.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of network security technology, and in particular, to a method, device, electronic device and storage medium for detecting a database collision attack. Background Art

[0002] With the rapid development of the Internet, a large number of websites and mobile applications have emerged. Each user may have multiple accounts on different websites. For the convenience of memory, these accounts often use the same account and password. This leads to serious security issues. When the user data of a website or mobile application is leaked, it may cause the user's information on other websites and mobile applications to be leaked. In recent years, the impact of credential stuffing attacks on users has become increasingly significant.

[0003] In the existing technology, the detection of credential stuffing attacks mainly relies on manual analysis of the size of network traffic. During the detection process, the credential stuffing attack may be overlooked due to the small network traffic. Therefore, the existing credential stuffing attack detection method is both inefficient and prone to errors. It cannot guarantee the security of user accounts and brings immeasurable losses to users. Summary of the invention

[0004] In view of this, in order to effectively alleviate the problems of low efficiency and easy errors caused by manual detection of credential stuffing attacks, embodiments of the present invention provide a method, device, electronic device and storage medium for detecting credential stuffing attacks.

[0005] In a first aspect, an embodiment of the present invention provides a method for detecting a credential stuffing attack, the method comprising:

[0006] Obtain multiple related information of the login web page and user login behavior data in real time;

[0007] Determine conflicting information from multiple related information, and count the total number of conflicts of the conflicting information within a preset time period;

[0008] Determining whether the conflict information is abnormal based on the total number of conflicts;

[0009] When it is determined that the conflicting information is abnormal, detect whether the login web page is a database collision attack based on the user login behavior data.

[0010] In a possible implementation, determining conflicting information from a plurality of associated information includes:

[0011] Mark each related information with front-end information;

[0012] The conflict information is determined based on the front-end information corresponding to each piece of associated information.

[0013] In a possible implementation, conflict information is determined based on the front-end information corresponding to each piece of associated information:

[0014] The associated information that is inconsistent with the front-end information is determined as conflicting information.

[0015] In a possible implementation, determining whether the conflict information is abnormal based on the total number of conflicts includes:

[0016] Obtaining the predicted total number of conflicts for a preset time period output by a pre-trained total number of conflicts prediction model; wherein the total number of conflicts prediction model is a prediction model obtained by training a time series model based on the total number of historical conflicts;

[0017] Whether the conflict information is abnormal is determined based on the predicted total number of conflicts and the total number of conflicts.

[0018] In a possible implementation, determining whether the conflict information is abnormal according to the predicted total number of conflicts and the total number of conflicts includes:

[0019] Determine the difference in number based on the predicted total number of conflicts and the total number of conflicts;

[0020] Determine whether the quantity difference is greater than a preset quantity difference;

[0021] In the case where the difference in quantity is determined to be greater than a preset difference in quantity, determining that the conflict information is abnormal;

[0022] In the case where it is determined that the quantity difference is less than or equal to the preset quantity difference, it is determined that there is no abnormality in the conflict information;

[0023] In one possible implementation, detecting whether a login web page is a credential stuffing attack based on user login behavior data includes:

[0024] Obtain at least one credential stuffing attack feature data from the user login behavior data;

[0025] Based on at least one credential stuffing attack characteristic data, it is detected whether the login network page is a credential stuffing attack.

[0026] In a possible implementation, detecting whether a login web page is a credential stuffing attack based on at least one credential stuffing attack feature data includes:

[0027] For each of the at least one credential stuffing attack characteristic data, determining whether the credential stuffing attack characteristic data exceeds a preset data threshold;

[0028] When it is determined that at least one characteristic data of a credential stuffing attack exceeds a preset data threshold, the login network page is detected as a credential stuffing attack.

[0029] In one possible implementation, the method further includes:

[0030] When a login web page is detected as a credential stuffing attack, the login web page is restricted and a password change prompt is sent to the user.

[0031] In a second aspect, an embodiment of the present invention provides a device for detecting a credential stuffing attack, the device comprising:

[0032] The acquisition module is used to acquire multiple related information of the login network page and user login behavior data in real time;

[0033] A determination and statistics module is used to determine conflicting information from multiple related information and to count the total number of conflicts of the conflicting information within a preset time period;

[0034] An abnormality determination module, used to determine whether the conflict information is abnormal based on the total number of conflicts;

[0035] The credential stuffing attack detection module is used to detect whether the login web page is a credential stuffing attack based on the user login behavior data when the conflicting information is determined to be abnormal.

[0036] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: a processor and a memory, wherein the processor is used to execute a program for detecting credential stuffing attacks stored in the memory to implement the above-mentioned method for detecting credential stuffing attacks.

[0037] In a fourth aspect, an embodiment of the present invention provides a storage medium, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above-mentioned method for detecting database stuffing attacks.

[0038] The method, device, electronic device and storage medium for detecting a database collision attack provided by an embodiment of the present invention include: obtaining multiple associated information and user login behavior data of a login network page in real time; determining conflict information from multiple associated information, and counting the total number of conflicts of the conflict information within a preset time period; determining whether the conflict information is abnormal based on the total number of conflicts; and detecting whether the login network page is a database collision attack based on the user login behavior data when it is determined that the conflict information is abnormal. The above technical solution can automatically detect a database collision attack through multiple associated information and user login behavior data of a login network page. No manual participation is required in the detection process, which effectively alleviates the inefficiency and error-prone problems caused by the existing manual detection of database collision attacks, ensures the user's account security, and thus avoids immeasurable losses to the user. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A flowchart of an embodiment of a method for detecting a credential stuffing attack provided by an embodiment of the present invention;

[0040] Figure 2 A flowchart of another method for detecting a credential stuffing attack provided by an embodiment of the present invention;

[0041] Figure 3 A flowchart of another method for detecting a credential stuffing attack provided by an embodiment of the present invention;

[0042] Figure 4 A flowchart of another method for detecting a credential stuffing attack provided by an embodiment of the present invention;

[0043] Figure 5 A block diagram of an embodiment of a device for detecting a credential stuffing attack provided by an embodiment of the present invention;

[0044] Figure 6 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] To facilitate understanding of the embodiments of the present invention, specific embodiments will be further explained below in conjunction with the accompanying drawings. The embodiments do not constitute a limitation on the embodiments of the present invention.

[0047] An embodiment of the present invention provides a method for detecting a credential stuffing attack, which can be performed by a credential stuffing attack detection device. In this embodiment, the credential stuffing attack detection device can be a computing device such as a desktop computer, a notebook, a PDA, and a server, and this embodiment is not limited to this.

[0048] See also Figure 1 , Figure 1 A flowchart of an embodiment of a method for detecting a credential stuffing attack provided in an embodiment of the present invention. Figure 1 The process shown may include the following steps:

[0049] Step 101, obtaining multiple associated information of the login network page and user login behavior data in real time;

[0050] The above-mentioned associated information and user behavior data are information related to the login web page, wherein the associated information can be understood as relevant information about the login operation web page when logging in to the application, web page or website through the web page based on the account and password. Multiple associated information include but are not limited to terminal information for identifying the type of web page, device information for identifying the login device, user agent information for identifying browser information, and request header field information for identifying the web page link, etc.; user login behavior data can be understood as behavior data related to the login operation, including but not limited to login frequency, number of login failures, number of successful logins, etc.

[0051] It can be understood that the web page is embedded with preset information and data collection code, which is used to collect the associated information and user login behavior data of logging into the above-mentioned web page, and detect whether the login web page is a database collision attack by automatically analyzing the obtained multiple associated information and user login behavior data.

[0052] Step 102, determining conflicting information from multiple pieces of associated information, and counting the total number of conflicts of the conflicting information within a preset time period;

[0053] Conflicting information can be understood as abnormal or contradictory information generated during the process of logging into a web page. In actual application, if logging into the above-mentioned web page is not a database collision attack, the above-mentioned multiple related information does not contain abnormal or contradictory information, and can uniformly identify that the logged-in web page is normal login information from the user. If logging into the above-mentioned web page is a database collision attack, the above-mentioned multiple related information contains abnormal or contradictory information, and cannot uniformly identify that the logged-in web page is normal login information from the user.

[0054] Continuing with the previous example, the end information, device information, user agent information and request header field information are used as multiple related information for explanation. If the end information and device information are a group of conflicting information, and the end information and request header field information are a group of conflicting information in a login to a network page, then the number of conflicting information conflicts when logging into the network page this time is 2. In this embodiment, if the preset time is one hour to count the number of conflicts when logging into the network page, it can be understood that multiple related information is obtained each time the above network page is logged in within one hour, and then the number of conflicts of the conflicting information must be determined for each login, and then the sum of all conflicts within one hour is counted, that is, the total number of conflicts. In specific implementation, the preset time can be set according to actual needs and is not limited here.

[0055] Step 103, determining whether the conflict information is abnormal based on the total number of conflicts;

[0056] In the process of logging into a network page, there may be conflicting information between related information caused by factors such as information acquisition errors and network failures. In this case, it is normal for conflicting information to exist between multiple related information, and the existence of conflicting information cannot be considered as an abnormality caused by a database collision attack. Therefore, in order to identify whether the conflicting information is normal information or abnormal information generated in the login network page, in this embodiment, it is necessary to determine whether the conflicting information is abnormal based on the total number of conflicts.

[0057] Step 104: When it is determined that the conflict information is abnormal, detect whether the login web page is a database collision attack based on the user login behavior data.

[0058] In the process of logging into a web page, there may be a situation where the conflict information is determined to be abnormal due to multiple automated system attempts to log in. In this case, there is a certain inaccuracy in determining that logging into the above web page is a database stuffing attack based solely on the fact that the conflict information is abnormal. Therefore, when it is determined that the conflict information is abnormal, it is necessary to further detect whether the login to the web page is a database stuffing attack through user login behavior data to ensure the accuracy of the detection.

[0059] The method for detecting a database collision attack provided by an embodiment of the present invention includes: obtaining multiple associated information of a login network page and user login behavior data in real time; determining conflict information from multiple associated information, and counting the total number of conflicts of the conflict information within a preset time period; determining whether the conflict information is abnormal based on the total number of conflicts; and detecting whether the login network page is a database collision attack based on the user login behavior data when the conflict information is determined to be abnormal. The above technical solution can automatically analyze and detect database collision attacks through multiple associated information of the login network page and user login behavior data. No manual participation is required in the detection process, which effectively alleviates the inefficiency and error-prone problems caused by the existing manual detection of database collision attacks, ensures the user's account security, and thus avoids immeasurable losses to the user.

[0060] like Figure 2 As shown, as an optional implementation, as in the above method, the above step 102 of determining conflicting information from multiple associated information includes the following steps:

[0061] Step 201, marking each associated information with front-end information;

[0062] In this embodiment, the front-end information can be divided into five front-end information: WEB (World Wide Web), IOS H5 (Internetworking Operating System HyperText Markup Language 5), Android H5 (Android HyperText Markup Language 5), IOS, and Android, which are used to briefly identify each related information. One related information is marked with one front-end information. It can be understood that when the login network page is normal, the front-end information marked by each related information is the same. Therefore, the front-end information marked by each related information can determine whether there is conflicting information between multiple related information.

[0063] To facilitate understanding of the labeling process, user agent information is used as an example for explanation, for example: user_agent ==》Mozilla / 5.0 (iPhone; CPU iPhone OS16_6like Mac OS X) AppleWebKit / 605.1.15 (KHTML, like Gecko) CriOS / 129.0.1 Mobile / 15E148 Safari / 604.1 ==》 This Mozilla / 5.0 (iPhone; CPU iPhone OS16_6like Mac OS X): This indicates that the login device is an iPhone, which is running iOS16.6; CriOS / 129.0.1: CriOS indicates the version information of Google Chrome for iOS, which is 129.0.1; the comprehensive judgment is that it comes from the Google Chrome browser running on the iPhone device. Labeled as IOS H5.

[0064] Step 202: determining conflict information based on the front-end information corresponding to each piece of associated information.

[0065] Specifically, the associated information that is inconsistent with the front-end information is determined as conflict information; continuing with the previous example, for example, the end information is marked as WEB, the device information is marked as IOS H5, the user agent information is marked as WEB, and the request header field information is marked as Android. In this embodiment, the front-end information marked with the end information is used as the comparison object, and the associated information that is inconsistent with the front-end information marked with the end information is determined as a group of conflict information, that is, if the device information is inconsistent with the front-end information marked with the end information, then the device information and the end information are determined as a group of conflict information, and if the request header field information is inconsistent with the front-end information marked with the end information, then the request header field information and the end information are determined as a group of conflict information.

[0066] Through the method in this embodiment, the front-end information marked with each related information can be used to quickly and accurately determine the conflicting information between multiple related information when logging into the above-mentioned network page, providing detection data for database collision attacks, facilitating the accurate detection of subsequent database collision attacks, and improving the efficiency of database collision attack detection.

[0067] like Figure 3 As shown, as an optional implementation, as in the above method, the above step 103 determines whether the conflict information is abnormal based on the total number of conflicts, including the following steps:

[0068] Step 301, obtaining the predicted total number of conflicts for a preset duration output by a pre-trained total number of conflicts prediction model;

[0069] Among them, the total number of conflicts prediction model is a prediction model obtained by training the time series model based on the total number of historical conflicts; the time series model can be an autoregressive moving average model, an autoregressive integrated moving average model, a vector autoregressive model or an exponentially weighted moving average model, etc., which is not limited here.

[0070] In order to facilitate the understanding of the training and prediction process of the total number of conflicts prediction model, the exponentially weighted moving average model is used as an example:

[0071] Step 1: Input a set of total number of conflicts into the exponentially weighted moving average model, the total number of conflicts at 12:00 every day in the past week, 7 sets of data. Let these data be: x_1, x_2, x_3, ..., x_7.

[0072] Step 2, select a smoothing factor λ, usually between 0.2 and 0.3; λ represents the data weight, and different data weights have different effects on the sensitivity of the model. Here, λ is set to 0.3. Define the initial mean S_0, which can be set to the total number of conflicts on the first day, S_0 = x_1.

[0073] Step 3, calculate the exponentially weighted moving average sequence, and calculate the exponentially weighted moving average of each time point, namely S_t, according to the following formula: [S_t=λx_t+(1-λ)S_{t-1}].

[0074] Step 4: Get the exponentially weighted moving average for the past week based on the above calculation steps:

[0075] (S_1=x_1);

[0076] (S_2=λx_2+(1-λ)S_1);

[0077] (S_3=λx_3+(1-λ)S_2);

[0078] And so on until (S_7), using (S_7) as the total number of predicted conflicts for the next preset duration.

[0079] The training and prediction processes of other time series models will not be described here one by one.

[0080] Step 302: Determine whether the conflict information is abnormal based on the predicted total number of conflicts and the total number of conflicts.

[0081] Specifically, the implementation process of the above step 302 is: determining a quantity difference according to the predicted total number of conflicts and the total number of conflicts; determining whether the quantity difference is greater than a preset quantity difference; if it is determined that the quantity difference is greater than the preset quantity difference, determining that the conflict information is abnormal; if it is determined that the quantity difference is less than or equal to the preset quantity difference, determining that the conflict information is normal;

[0082] In this embodiment, a preset number difference L can be set according to the demand. The threshold defines the maximum error range allowed between the total number of conflicts and the predicted total number of conflicts within the current preset time length. For example, L=3σ is set, where σ is the standard deviation of the residual. When |total number of conflicts-predicted total number of conflicts|>L, that is, the number difference is greater than the preset number difference L, the conflict information is considered abnormal. Conversely, when the number difference is equal to or less than the preset number difference L, the conflict information is considered normal.

[0083] like Figure 4 As shown, as an optional implementation, as in the aforementioned method, the above step 104 detects whether the login web page is a credential stuffing attack based on the user login behavior data, including the following steps:

[0084] Step 401, obtaining at least one credential stuffing attack feature data from user login behavior data;

[0085] The credential stuffing attack characteristic data can be understood as user login behavior data related to the credential stuffing attack. For example, the login frequency and the number of login failures are obtained from the user login behavior data as the credential stuffing attack characteristic data.

[0086] Step 402: Detect whether the login web page is a credential stuffing attack based on at least one credential stuffing attack feature data.

[0087] The specific process of step 402 determining whether it is a credential stuffing attack is: for each credential stuffing attack feature data in at least one credential stuffing attack feature data, determining whether the credential stuffing attack feature data exceeds a preset data threshold; if it is determined that at least one credential stuffing attack feature data exceeds the preset data threshold, detecting that the login web page is a credential stuffing attack.

[0088] In actual application, each characteristic data of a credential stuffing attack is set to correspond to a preset data threshold. Continuing with the previous example, the preset data threshold corresponding to the characteristic data of the credential stuffing attack, the login frequency, is 100 times, and the preset data threshold corresponding to the characteristic data of the credential stuffing attack, the number of login failures, is 150 times. Then, as long as the login frequency exceeds 100 times and / or the number of login failures exceeds 150 times, the login to the web page is considered to be a credential stuffing attack. If the login frequency does not exceed 100 times and the number of login failures does not exceed 150 times, it is not considered a credential stuffing attack. Among them, the preset data threshold corresponding to each characteristic data of a credential stuffing attack can be set according to actual needs and is not limited here.

[0089] Usually, in order to protect the user's account security, if it is detected that the login web page is a credential stuffing attack, the login web page can be restricted and a password change prompt message can be sent to the user.

[0090] Specifically, the login to the web page can be restricted by blocking the IP (Internet Protocol), and a password change reminder message can be sent to the terminal device used by the real user of the account to prompt the user to change the password of the account as soon as possible to ensure the security of the account.

[0091] See also Figure 5 , is a block diagram of an embodiment of a device for detecting a credential stuffing attack provided by an embodiment of the present invention. Figure 5 As shown, the device comprises:

[0092] The acquisition module 501 is used to acquire multiple associated information of the login network page and user login behavior data in real time;

[0093] A determination and statistics module 502 is used to determine conflict information from multiple related information and count the total number of conflicts of the conflict information within a preset time period;

[0094] An abnormality determination module 503, used to determine whether the conflict information is abnormal based on the total number of conflicts;

[0095] The credential stuffing attack detection module 504 is used to detect whether the login web page is a credential stuffing attack based on the user login behavior data when it is determined that the conflicting information is abnormal.

[0096] The device for detecting a database collision attack provided by an embodiment of the present invention includes: obtaining multiple associated information of a login network page and user login behavior data in real time; determining conflict information from multiple associated information, and counting the total number of conflicts of the conflict information within a preset time period; determining whether the conflict information is abnormal based on the total number of conflicts; and detecting whether the login network page is a database collision attack based on the user login behavior data when the conflict information is determined to be abnormal. The above technical solution can automatically detect a database collision attack through multiple associated information of a login network page and user login behavior data. No manual participation is required in the detection process, which effectively alleviates the inefficiency and error-prone problems caused by the existing manual detection of database collision attacks, ensures the user's account security, and thus avoids immeasurable losses to the user.

[0097] Figure 6 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention, Figure 6 The electronic device 1200 shown includes: at least one processor 1201, a memory 1202, at least one network interface 1204 and other user interfaces 1203. The various components in the electronic device 1200 are coupled together via a bus system 1205. It is understood that the bus system 1205 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 1205 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the bus system 1205 is not described in detail. Figure 6 Various buses are labeled as bus system 1205.

[0098] The user interface 1203 may include a display, a keyboard, or a pointing device (eg, a mouse, a trackball, a touch pad, or a touch screen).

[0099] It can be understood that the memory 1202 in the embodiment of the present invention can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus random access memory (DRRAM). The memory 1202 described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0100] In some embodiments, the memory 1202 stores the following elements, executable units or data structures, or a subset thereof, or an extended set thereof: an operating system 12021 and an application program 12022 .

[0101] The operating system 12021 includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., which are used to implement various basic services and process hardware-based tasks. The application 12022 includes various application programs, such as a media player (Media Player), a browser (Browser), etc., which are used to implement various application services. The program for implementing the method of the embodiment of the present invention can be included in the application 12022.

[0102] In the embodiment of the present invention, by calling the program or instruction stored in the memory 1202, specifically, the program or instruction stored in the application 12022, the processor 1201 is used to execute the method steps provided by each method embodiment, for example, including:

[0103] Obtain multiple related information of the login web page and user login behavior data in real time;

[0104] Determine conflicting information from multiple related information, and count the total number of conflicts of the conflicting information within a preset time period;

[0105] Determining whether the conflict information is abnormal based on the total number of conflicts;

[0106] When it is determined that the conflicting information is abnormal, detect whether the login web page is a database collision attack based on the user login behavior data.

[0107] In a possible implementation, determining conflicting information from a plurality of associated information includes:

[0108] Mark each related information with front-end information;

[0109] The conflict information is determined based on the front-end information corresponding to each piece of associated information.

[0110] In a possible implementation, conflict information is determined based on the front-end information corresponding to each piece of associated information:

[0111] The associated information that is inconsistent with the front-end information is determined as conflicting information.

[0112] In a possible implementation, determining whether the conflict information is abnormal based on the total number of conflicts includes:

[0113] Obtaining the predicted total number of conflicts for a preset time period output by a pre-trained total number of conflicts prediction model; wherein the total number of conflicts prediction model is a prediction model obtained by training a time series model based on the total number of historical conflicts;

[0114] Whether the conflict information is abnormal is determined based on the predicted total number of conflicts and the total number of conflicts.

[0115] In a possible implementation, determining whether the conflict information is abnormal according to the predicted total number of conflicts and the total number of conflicts includes:

[0116] Determine the difference in number based on the predicted total number of conflicts and the total number of conflicts;

[0117] Determine whether the quantity difference is greater than a preset quantity difference;

[0118] In the case where the difference in quantity is determined to be greater than a preset difference in quantity, determining that the conflict information is abnormal;

[0119] In the case where it is determined that the quantity difference is less than or equal to the preset quantity difference, it is determined that there is no abnormality in the conflict information;

[0120] In one possible implementation, detecting whether a login web page is a credential stuffing attack based on user login behavior data includes:

[0121] Obtain at least one credential stuffing attack feature data from the user login behavior data;

[0122] Based on at least one credential stuffing attack characteristic data, it is detected whether the login network page is a credential stuffing attack.

[0123] In a possible implementation, detecting whether a login web page is a credential stuffing attack based on at least one credential stuffing attack feature data includes:

[0124] For each of the at least one credential stuffing attack characteristic data, determining whether the credential stuffing attack characteristic data exceeds a preset data threshold;

[0125] When it is determined that at least one characteristic data of a credential stuffing attack exceeds a preset data threshold, the login network page is detected as a credential stuffing attack.

[0126] In one possible implementation, the method further includes:

[0127] When a login web page is detected as a credential stuffing attack, the login web page is restricted and a password change prompt is sent to the user.

[0128] The method disclosed in the above embodiment of the present invention can be applied to the processor 1201, or implemented by the processor 1201. The processor 1201 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 1201. The above processor 1201 can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiment of the present invention can be directly embodied as a hardware decoding processor to execute, or the hardware and software units in the decoding processor can be executed. The software unit can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 1202, and the processor 1201 reads the information in the memory 1202 and completes the steps of the above method in combination with its hardware.

[0129] It is understood that the embodiments described herein may be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit may be implemented in one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPDevice, DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), general purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described in the present application, or a combination thereof.

[0130] For software implementation, the technology described herein can be implemented by a unit that performs the functions described herein. The software code can be stored in a memory and executed by a processor. The memory can be implemented in the processor or outside the processor.

[0131] The electronic device provided in this embodiment may be Figure 6 The electronic device shown in FIG. 1 may perform the following steps: Figure 1-5 All steps of the method for detecting credential stuffing attacks in Figure 1-5 For details, please refer to the technical effect of the method for detecting credential stuffing attacks shown in Figure 1-2 For the sake of brevity, the relevant description is not repeated here.

[0132] The embodiment of the present invention also provides a storage medium (computer-readable storage medium). The storage medium here stores one or more programs. The storage medium may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a read-only memory, a flash memory, a hard disk or a solid-state drive; the memory may also include a combination of the above-mentioned types of memory.

[0133] When one or more programs in the storage medium can be executed by one or more processors, the above-mentioned method of detecting credential stuffing attacks can be implemented.

[0134] The processor is used to execute a credential stuffing attack detection program stored in the memory to implement the following steps of a credential stuffing attack detection method:

[0135] Obtain multiple related information of the login web page and user login behavior data in real time;

[0136] Determine conflicting information from multiple related information, and count the total number of conflicts of the conflicting information within a preset time period;

[0137] Determining whether the conflict information is abnormal based on the total number of conflicts;

[0138] When it is determined that the conflicting information is abnormal, detect whether the login web page is a database collision attack based on the user login behavior data.

[0139] In a possible implementation, determining conflicting information from a plurality of associated information includes:

[0140] Mark each related information with front-end information;

[0141] The conflict information is determined based on the front-end information corresponding to each piece of associated information.

[0142] In a possible implementation, conflict information is determined based on the front-end information corresponding to each piece of associated information:

[0143] The associated information that is inconsistent with the front-end information is determined as conflicting information.

[0144] In a possible implementation, determining whether the conflict information is abnormal based on the total number of conflicts includes:

[0145] Obtaining the predicted total number of conflicts for a preset time period output by a pre-trained total number of conflicts prediction model; wherein the total number of conflicts prediction model is a prediction model obtained by training a time series model based on the total number of historical conflicts;

[0146] Whether the conflict information is abnormal is determined based on the predicted total number of conflicts and the total number of conflicts.

[0147] In a possible implementation, determining whether the conflict information is abnormal according to the predicted total number of conflicts and the total number of conflicts includes:

[0148] Determine the difference in number based on the predicted total number of conflicts and the total number of conflicts;

[0149] Determine whether the quantity difference is greater than a preset quantity difference;

[0150] In the case where the difference in quantity is determined to be greater than a preset difference in quantity, determining that the conflict information is abnormal;

[0151] In the case where it is determined that the quantity difference is less than or equal to the preset quantity difference, it is determined that there is no abnormality in the conflict information;

[0152] In one possible implementation, detecting whether a login web page is a credential stuffing attack based on user login behavior data includes:

[0153] Obtain at least one credential stuffing attack feature data from the user login behavior data;

[0154] Based on at least one credential stuffing attack characteristic data, it is detected whether the login network page is a credential stuffing attack.

[0155] In a possible implementation, detecting whether a login web page is a credential stuffing attack based on at least one credential stuffing attack feature data includes:

[0156] For each of the at least one credential stuffing attack characteristic data, determining whether the credential stuffing attack characteristic data exceeds a preset data threshold;

[0157] When it is determined that at least one characteristic data of a credential stuffing attack exceeds a preset data threshold, the login network page is detected as a credential stuffing attack.

[0158] In one possible implementation, the method further includes:

[0159] When a login web page is detected as a credential stuffing attack, the login web page is restricted and a password change prompt is sent to the user.

[0160] The professionals should further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0161] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0162] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for detecting a credential stuffing attack, characterized in that: The method comprises: Obtain multiple related information of the login web page and user login behavior data in real time; Determine conflicting information from the plurality of associated information, and count the total number of conflicts of the conflicting information within a preset time period; Determining whether the conflict information is abnormal based on the total number of conflicts; When it is determined that the conflict information is abnormal, it is detected based on the user login behavior data whether the login to the web page is a database collision attack.

2. The method according to claim 1, characterized in that The determining conflicting information from the plurality of associated information comprises: Performing front-end information tagging on each of the associated information; Conflict information is determined based on the front-end information corresponding to each of the associated information.

3. The method according to claim 2, characterized in that The conflict information is determined based on the front-end information corresponding to each of the associated information: The associated information that is inconsistent with the front-end information is determined as conflicting information.

4. The method according to claim 1, characterized in that: The determining whether the conflict information is abnormal based on the total number of conflicts includes: Obtaining the predicted total number of conflicts for the preset duration output by a pre-trained total number of conflicts prediction model; wherein the total number of conflicts prediction model is a prediction model obtained by training a time series model based on the total number of historical conflicts; Whether the conflict information is abnormal is determined according to the predicted total number of conflicts and the total number of conflicts.

5. The method according to claim 4, characterized in that The determining whether the conflict information is abnormal according to the predicted total number of conflicts and the total number of conflicts includes: Determining a quantity difference according to the predicted total number of conflicts and the total number of conflicts; Determining whether the quantity difference is greater than a preset quantity difference; In the case where it is determined that the quantity difference is greater than the preset quantity difference, determining that the conflict information is abnormal; When it is determined that the quantity difference is less than or equal to the preset quantity difference, it is determined that there is no abnormality in the conflict information.

6. The method according to claim 1, characterized in that The detecting, based on the user login behavior data, whether logging into the network page is a credential stuffing attack comprises: Acquire at least one credential stuffing attack feature data from the user login behavior data; Based on at least one of the credential stuffing attack feature data, it is detected whether logging into the network page is a credential stuffing attack.

7. The method according to claim 6, characterized in that The detecting whether logging into the web page is a credential stuffing attack based on at least one credential stuffing attack feature data comprises: For each of the at least one credential stuffing attack characteristic data, determining whether the credential stuffing attack characteristic data exceeds a preset data threshold; When it is determined that at least one of the characteristic data of the credential stuffing attack exceeds a preset data threshold, logging into the network page is detected as a credential stuffing attack.

8. The method according to claim 1, characterized in that The method further comprises: In the case where it is detected that the login to the web page is a database collision attack, the login to the web page is restricted and a password modification prompt is sent to the user.

9. A device for detecting a database collision attack, characterized in that: The device comprises: The acquisition module is used to acquire multiple related information of the login network page and user login behavior data in real time; A determination and statistics module is used to determine conflict information from the plurality of associated information and to count the total number of conflicts of the conflict information within a preset time period; an abnormality determination module, used to determine whether the conflict information is abnormal based on the total number of conflicts; The credential stuffing attack detection module is used to detect whether logging into the web page is a credential stuffing attack based on the user login behavior data when it is determined that the conflict information is abnormal.

10. An electronic device, characterized in that: include: A processor and a memory, wherein the processor is used to execute a credential stuffing attack detection program stored in the memory to implement the credential stuffing attack detection method according to any one of claims 1 to 8.

11. A storage medium, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method for detecting credential stuffing attacks according to any one of claims 1 to 8.

Images