RDP brute force cracking detection method and device

Abstract

The invention relates to the technical field of network intrusion detection, and discloses an RDP brute force cracking detection method and device, and the method comprises the steps: obtaining transmission data, and determining whether the transmission data is an RDP data flow or not through a preset method; when the transmission data is the RDP data stream, determining an RDP protocol version corresponding to the RDP data stream; when the RDP protocol version of the RDP data stream is a first version, detecting whether brute force cracking exists between an RDP server and a client by adopting a first detection method; and when the RDP protocol version of the RDP data stream is a second version, detecting whether brute force cracking exists between the RDP server and the client by adopting a second detection method. According to the method provided by the embodiment of the invention, the corresponding detection method is determined according to the version of the RDP protocol, and whether brute force cracking exists between the RDP server and the client can be more easily detected, so that the accuracy of RDP brute force cracking detection is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network intrusion detection, and in particular to a RDP brute force cracking detection method and device. Background Art

[0002] Remote Desktop Protocol (RPD) is a protocol that allows users to remotely access computer desktops. It is widely used by enterprises and individuals for remote work. RDP may become a target of network intrusion, especially through brute force cracking to obtain the login credentials of the remote computer. Although the success rate of RDP brute force cracking attacks is low, the attacks are frequent and persistent, posing a threat to network security.

[0003] In the related technologies, there is often the possibility of false positives and false negatives of brute force cracking behaviors, and the effect of brute force cracking identification is not accurate enough, which poses a great threat to the security of the network and system, and a better solution is needed. Summary of the invention

[0004] In view of this, the present invention provides an RDP brute force cracking detection method and device to solve the problem of low system security caused by poor recognition effect when a device using the RDP protocol is subjected to brute force cracking.

[0005] On one hand, the present disclosure provides an RDP brute force cracking detection method, the method comprising: obtaining transmission data between an RDP server and a client, and using a preset method to determine whether the transmission data is an RDP data stream; when the transmission data is an RDP data stream, when the result of performing RDP protocol verification on the RDP data stream is that the verification is passed, determining an RDP protocol version corresponding to the RDP data stream, the RDP protocol version being used to characterize whether the RDP protocol that the RDP data stream complies with is a first version or a second version; when the RDP protocol version of the RDP data stream is the first version, using a first detection method to detect whether there is a brute force cracking between the RDP server and the client; when the RDP protocol version of the RDP data stream is the second version, using a second detection method to detect whether there is a brute force cracking between the RDP server and the client.

[0006] On the other hand, the present disclosure further provides a detection device, which includes a first determination module, which is used to obtain transmission data between an RDP server and a client, and use a preset method to determine whether the transmission data is an RDP data stream; a second determination module, which is used to determine the RDP protocol version corresponding to the RDP data stream when the result of performing RDP protocol verification on the RDP data stream is verification passed when the transmission data is an RDP data stream, and the RDP protocol version is used to characterize whether the RDP protocol that the RDP data stream complies with is a first version or a second version; a first detection module, which is used to detect whether there is brute force cracking between the RDP server and the client when the RDP protocol version of the RDP data stream is the first version; and a second detection module, which is used to detect whether there is brute force cracking between the RDP server and the client when the RDP protocol version of the RDP data stream is the second version.

[0007] On the other hand, the present disclosure further provides a computer-readable storage medium, on which computer instructions are stored, and the computer instructions are used to enable a computer to implement the above-mentioned RDP brute force cracking detection method.

[0008] On the other hand, the present disclosure further provides a computer program product, including computer instructions, where the computer instructions are used to enable a computer to execute the above-mentioned RDP brute force cracking detection method.

[0009] By using the RDP brute force cracking detection method and detection device of the above-mentioned embodiment of the present disclosure, by obtaining the RDP data stream between the RDP server and the client, performing RDP protocol verification on the RDP data stream, determining the RDP protocol version corresponding to the RDP data stream, and according to the different protocol versions of the RDP data stream, respectively using the first detection method or the second detection method to perform brute force cracking detection on the RDP data stream to determine whether brute force cracking exists between the RDP server and the client, and determining the corresponding detection method based on the version of the RDP protocol, it is easier to detect whether brute force cracking exists between the RDP server and the client, thereby improving the accuracy of RDP brute force cracking detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the specific embodiments of the present disclosure or the technical solutions in the related technologies, the drawings required for use in the specific embodiments or the related technical descriptions will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0011] Figure 1a An exemplary schematic diagram showing the architecture of a detection device applied to an RDP brute force cracking detection method according to an embodiment of the present disclosure;

[0012] Figure 1b It is a flowchart of an RDP brute force cracking detection method provided by an embodiment of the present disclosure;

[0013] Figure 2 It is a schematic diagram of an RDP protocol verification process of an RDP brute force cracking detection method provided by an embodiment of the present disclosure;

[0014] Figure 3 This is a flow chart of a first detection method of an RDP brute force cracking detection method provided by an embodiment of the present disclosure;

[0015] Figure 4 This is a flow chart of a second detection method of an RDP brute force cracking detection method provided by an embodiment of the present disclosure;

[0016] Figure 5 is a structural schematic diagram of a detection device provided by an embodiment of the present disclosure;

[0017] Figure 6 It is a structural schematic diagram of another detection device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0018] RDP is a protocol for remote desktop access that allows users to connect to a computer with this feature enabled over the network and perform tasks similar to local operations. RDP has a wide range of applications in scenarios such as remote management, technical support, and remote office, and is an indispensable part of modern information technology infrastructure. However, the ubiquity of RDP also makes it a target for attackers, especially those who use brute force to obtain login credentials for remote computers.

[0019] According to relevant security analysis reports, RDP brute force attacks are a major threat in the current network security field. Hundreds of computers may be attacked by brute force attacks every day. Although the attack duration is usually short, about 90% of the attacks will end within 1 week, and the attack duration is usually 2-3 days, brute force attacks still occur frequently. The report pointed out that although the success rate of RDP brute force attacks is low, only about 0.08% of the attempts are ultimately successful, considering the high frequency and persistence of the attacks, this still puts tremendous pressure on network security.

[0020] The related technologies often have the following problems:

[0021] 1. In the related technologies, the RDP protocol version is usually ignored during the brute force cracking detection process, and only a single detection method is used, which may cause the detection method to be unable to adapt to the changes of different RDP protocol versions, thereby affecting the accuracy of the detection results;

[0022] 2. Related technologies usually perform brute force cracking detection based on detecting whether there are a large number of abnormal accesses in a short period of time, without paying attention to the relationship between the amount of bytes sent in each data stream and brute force cracking, which may reduce the accuracy and timeliness of brute force cracking detection;

[0023] 3. Brute force cracking detection in related technologies often focuses on the detection and statistics of the number of brute force cracking attempts, while ignoring the judgment of whether the brute force cracking is successful, resulting in insufficient comprehensiveness of the detection results.

[0024] To solve the above problems, various embodiments of the present disclosure provide an RDP brute force cracking detection method, the method comprising: obtaining transmission data between an RDP server and a client, and using a preset method to determine whether the transmission data is an RDP data stream; when the transmission data is an RDP data stream, when the result of performing RDP protocol verification on the RDP data stream is that the verification is passed, determining the RDP protocol version corresponding to the RDP data stream, the RDP protocol version is used to characterize whether the RDP protocol that the RDP data stream complies with is the first version or the second version; when the RDP protocol version of the RDP data stream is the first version, using a first detection method to detect whether there is a brute force cracking between the RDP server and the client; when the RDP protocol version of the RDP data stream is the second version, using a second detection method to detect whether there is a brute force cracking between the RDP server and the client.

[0025] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present disclosure.

[0026] Please refer to Figure 1a , Figure 1a An exemplary schematic diagram of the architecture of a detection device used in an RDP brute force cracking detection method according to an embodiment of the present disclosure is shown. Figure 1a As shown, the detection device may include: a determination module and a detection module.

[0027] like Figure 1a As shown, the detection device is deployed in the network environment where the RDP server and the client are located.

[0028] The deployment location of the detection device may include, but is not limited to: the network environment where the RDP server is located, the network environment where the client is located, or an intermediate network node between the client and the RDP server.

[0029] For example, the detection device may be deployed on a firewall of the RDP server or client, or may be deployed on a gateway between the client and the RDP server.

[0030] The determination module in the detection device can be used to determine the type and protocol version of the data stream between the client and the RDP server. The detection module in the detection device can be used to perform brute force detection using a corresponding detection method according to the protocol version of the data stream.

[0031] The RDP server can be a computer or device that receives and responds to remote desktop connection requests, and can be provided by an operating system that supports the RDP protocol; the client can be a device or application that initiates a remote desktop connection, allowing users to access the remote computer through a graphical interface, control the remote desktop and interact with it.

[0032] Further references Figure 1b , Figure 1b is a flow chart of a RDP brute force cracking detection method provided by the present disclosure, which is applied to the above Figure 1a The detection device shown in the figure, the process of the method may include the following steps:

[0033] Step S101, obtaining transmission data between the RDP server and the client, and using a preset method to determine whether the transmission data is an RDP data stream.

[0034] In this embodiment, the transmission data between the RDP server and the client may include various data packets and messages transmitted between the two parties; the RDP data stream may refer to the communication data stream between the RDP client and the server, and the RDP data stream may include but is not limited to various requests and input information from the client to the RDP server, as well as desktop images and status information from the server to the client.

[0035] As an example, an RDP data stream may include control packets and session packets, wherein the control packets may be used to manage the life cycle of a remote desktop session, control the transmission of information, etc., and the session packets may be used to transmit user input, screen images, device redirection, clipboard data, etc.

[0036] Here, the control data packet may include at least one of the following: a session initialization data packet, a handshake data packet, and an authentication data packet; the session data packet may include at least one of the following: an image update data packet, an input event data packet, and a clipboard synchronization data packet.

[0037] Adopting a preset method to determine whether the transmission data is an RDP data stream may refer to adopting a preset method to preliminarily determine whether the transmission data conforms to the characteristics of the RDP data stream.

[0038] As an example, using a preset method to determine whether the transmitted data is an RDP data stream may include but is not limited to: determining whether it is an RDP data stream based on a target port of the transmitted data, and determining whether it is an RDP data stream based on content characteristics of the transmitted data.

[0039] The RDP protocol used to transmit the RDP data stream uses the Transmission Control Protocol (TCP) port 3389 by default. Therefore, by checking whether the target port of the transmitted data is 3389, it can be preliminarily determined that the transmitted data meets the characteristics of the RDP data stream when the target port is 3389. The content characteristics of the RDP data stream may include user input events and desktop graphics transmission, and whether it is an RDP data stream can be determined based on the content characteristics.

[0040] Step S102: When the transmission data is an RDP data stream, when the result of performing RDP protocol verification on the RDP data stream is that the verification passes, determining the RDP protocol version corresponding to the RDP data stream.

[0041] In this embodiment, the RDP protocol version is used to indicate whether the RDP protocol to which the RDP data stream conforms is the first version or the second version, wherein the first version may be a new version, and the second version may be an old version.

[0042] Here, since there is an update to the RDP protocol version, the old version of the RDP protocol before the update uses the Secure Sockets Layer (SSL) encryption protocol, and the new version after the update uses the Transport Layer Security (TLS) encryption protocol.

[0043] Performing RDP protocol verification on the RDP data stream to determine the RDP protocol version corresponding to the RDP data stream may include: in an initial stage of a session between the RDP server and the client, detecting a protocol type adopted during a handshake negotiation between the RDP server and the client, and when it is determined that the adopted protocol type is the SSL protocol, determining that the RDP protocol version corresponding to the RDP data stream is the second version; when it is determined that the adopted protocol type is the TLS protocol, determining that the RDP protocol version corresponding to the RDP data stream is the first version.

[0044] Step S103: when the RDP protocol version of the RDP data stream is the first version, a first detection method is used to detect whether there is brute force cracking between the RDP server and the client.

[0045] In this embodiment, when the RDP protocol of the RDP data stream adopts the TLS protocol, a first detection method matching the TLS protocol is used to determine whether brute force cracking exists between the RDP server and the client.

[0046] As an example, methods for determining whether there is brute force cracking between the RDP server and the client may include, but are not limited to: determining based on a large number of failed login requests in a short period of time, determining based on the status code of the failed login, determining based on the number of times common password combinations appear, and determining based on the time interval between login attempts. Among them, common password combinations may include: "123456", "password", etc. If multiple login attempts of common password combinations are seen in a short period of time, it can be considered that there is a possible brute force cracking.

[0047] Step S104: when the RDP protocol version of the RDP data stream is the second version, a second detection method is used to detect whether there is brute force cracking between the RDP server and the client.

[0048] In this embodiment, when the RDP protocol of the RDP data stream adopts the SSL protocol, a first detection method matching the SSL protocol is used to determine whether brute force cracking exists between the RDP server and the client.

[0049] In the RDP brute force cracking detection method and detection device of the above-mentioned embodiment of the present disclosure, by obtaining the RDP data stream between the RDP server and the client, the RDP protocol verification is performed on the RDP data stream, and it is determined that the RDP protocol version corresponding to the RDP data stream is the TLS protocol or the SSL protocol. According to the different protocol versions of the RDP data stream, the first detection method or the second detection method is respectively used to perform brute force cracking detection on the RDP data stream to determine whether there is brute force cracking between the RDP server and the client. The corresponding detection method is determined according to the version of the RDP protocol, so that the detection method can adapt to the changes of different protocol versions, and the accuracy of RDP brute force cracking detection can be improved, thereby improving the security of the system; by using the first detection method and the second detection method according to the different RDP protocol versions, different brute force attack types can be covered, and the detection capability of complex attacks is enhanced.

[0050] In step S101 of the above embodiment, a preset method is used to determine whether the transmitted data is an RDP data stream, which is implemented based on the following steps:

[0051] Obtaining the first data packet after the TCP handshake in the transmission data, determining whether the first data packet contains a preset keyword, and when the first data packet contains the preset keyword, determining that the transmission data is an RDP data stream;

[0052] The method also includes: when the byte at the first preset position of the RDP data stream is a first value, determining that the RDP data stream is an RDP negotiation request packet sent by the client to the RDP server; when the byte at the first preset position of the RDP data stream is a second value, determining that the RDP data stream is an RDP negotiation response packet returned by the RDP server to the client.

[0053] In this embodiment, the TCP handshake may occur in the initial stage of establishing a connection between the client and the RDP server, and the TCP handshake may be used to establish a reliable TCP connection between the client and the RDP server. In the three-way handshake process of the TCP handshake, the client and the server exchange a series of control packets to ensure the reliability of the connection and the effectiveness of the two-way communication.

[0054] Furthermore, the first data packet after the TCP handshake may be the first application layer data packet after the three-way handshake is completed and data transmission begins.

[0055] Acquiring the first data packet after the TCP handshake in the transmission data and determining whether the first data packet contains a preset keyword may include: determining whether the first data packet contains the keyword "Cookie:mstshash=username".

[0056] Here, regardless of whether the client and the RDP server are successfully connected, the first data packet of the RDP data stream transmitted after the TCP handshake always contains the keyword "Cookie:mstshash=username". Therefore, whether the data packet contains the above keyword can be used as a basis for judging whether the data stream belongs to the RDP data stream.

[0057] Furthermore, when the first data packet includes a preset keyword, determining that the transmission data is an RDP data stream may include: when the first data packet includes a keyword of "Cookie:mstshash=username", determining that the transmission data is an RDP data stream.

[0058] Among them, the "Cookie" field is used in the RDP protocol to identify a specific session, and mstshash can be a specific form of hash value in the RDP protocol, which is used to identify the identity of the remote desktop session; the "user name" following mstshash can indicate the identity of the user that the client wants to log in when initiating a connection; because the above keywords contain user identity and session identifiers, they will appear in each RDP session and appear in the first data packet after the handshake to start the subsequent authentication and session establishment process.

[0059] When the byte at the first preset position of the RDP data stream is a first value, determining that the RDP data stream is an RDP negotiation request packet sent by the client to the RDP server may include: when determining that the eighth last byte of the RDP data stream is 0x01, determining that the RDP data stream is an RDP negotiation request packet sent by the client to the RDP server. The first preset position may refer to the eighth last byte of the RDP data stream, and the first value may refer to 0x01.

[0060] Here, in the data packet structure of the RDP protocol, the 8th byte from the end may refer to the header of the protocol message, which is used to store the flag of the message type or status. The hexadecimal 0x01 is converted to decimal 1, which can be used as the identifier of the negotiation request packet, indicating that the data packet is a request in the negotiation process.

[0061] When the byte at the first preset position of the RDP data stream is the second value, determining that the RDP data stream is the RDP negotiation response packet returned by the RDP server to the client may include: when determining that the eighth last byte of the RDP data stream is 0x02 (i.e., the second value), determining that the RDP data stream is the RDP negotiation response packet returned by the RDP server to the client. The second value may be 0x02.

[0062] Here, the hexadecimal 0x02 is converted to decimal 2, which can be used as an identifier of the negotiation response packet to indicate that the data packet is a response in the negotiation process.

[0063] Furthermore, when it is determined that the RDP data stream is an RDP negotiation request packet sent by the client to the RDP server and there is a brute force crack between the client and the RDP server, the client can be considered to be a brute force attacker; when it is determined that the RDP data stream is an RDP negotiation response packet returned by the RDP server to the client and there is a brute force crack between the client and the RDP server, the RDP server can be considered to be a brute force attacker.

[0064] In the RDP brute force cracking detection method and detection device of the above-mentioned embodiment of the present disclosure, by checking the first data packet after the TCP handshake and determining whether it contains a preset keyword, it is possible to quickly determine whether the transmitted data is an RDP data stream, thereby avoiding tedious packet-by-packet analysis of the entire data stream, thereby greatly improving the efficiency of data stream determination; by further analyzing only the traffic containing specific preset keywords, the overhead of comprehensive parsing of all traffic is avoided, thereby reducing interference with irrelevant data; by determining the position and value of specific bytes, the probability of false positives and false negatives can be reduced, thereby improving the accuracy of detection.

[0065] In step S102 of the above embodiment, RDP protocol verification is performed on the RDP data stream, which is implemented based on the following steps:

[0066] Based on the structural characteristics of the TPKT protocol, determine whether the RDP data stream complies with the TPKT protocol;

[0067] When the RDP data stream complies with the TPKT protocol, based on the structural characteristics of the X.224 protocol, it is determined whether the RDP data stream complies with the X.224 protocol; the X.224 protocol depends on the TPKT protocol;

[0068] When the RDP data stream complies with the X.224 protocol, it is determined that the result of performing RDP protocol verification on the RDP data stream is verification passed, wherein verification passed indicates that the RDP data complies with the RDP protocol; and the RDP protocol depends on the X.224 protocol.

[0069] In this embodiment, the TPKT protocol can be an application layer data transmission protocol, between TCP and Connection-Oriented Transport Protocol (COTP) protocol, used to build a bridge between COTP and TCP. The X.224 protocol can be a transport layer protocol in the RDP protocol, which can provide the function of establishing and managing RDP sessions in the network.

[0070] Here, the TPKT protocol encapsulates application layer data so that different application protocols can use the TCP protocol for reliable transmission, and ensures the integrity of data transmission by providing the structure of the data packet (including the header and data part); the X.224 protocol uses the TPKT protocol to encapsulate and transmit data, so the X.224 protocol depends on the TPKT protocol; the RDP protocol uses the X.224 protocol for session management and control information exchange, that is, the RDP message is first encapsulated and managed by X.224 during transmission, so the RDP protocol depends on the X.224 protocol.

[0071] Based on the structural characteristics of the TPKT protocol, determining whether the RDP data stream complies with the TPKT protocol may include: determining the first byte and the second byte in the data portion of the RDP data stream after being encapsulated by the TPKT protocol; if the first byte in the data portion is 0x03 and the second byte in the data portion is 0x00, determining that the RDP data stream complies with the TPKT protocol.

[0072] Here, the data part of the RDP data stream after TPKT protocol encapsulation can refer to the TCP payload, that is, the effective load part of the TCP data packet, that is, the part excluding the TCP header. The first byte is 0x03 and the second byte is 0x00, which is a feature of the data part after TPKT protocol encapsulation. The first two bytes of the TCP payload are 0x03 0x00, which is a fixed mark of the TPKT protocol header, used to identify the beginning of the TPKT data packet.

[0073] When the RDP data stream complies with the TPKT protocol, determining whether the RDP data stream complies with the X.224 protocol based on the structural characteristics of the X.224 protocol may include: when the first byte in the TCP payload is 0x03 and the second byte in the data part is 0x00, determining whether the sixth byte in the TCP payload is 0xe0 or 0xd0; when the sixth byte is 0xe0 or 0xd0, determining whether the RDP data stream complies with the X.224 protocol.

[0074] Here, the sixth byte in the TCP payload may be a PDU type field, which is used to identify whether the type of the current PDU data flow is a request or a response. Specifically, 0xe0 indicates a request, and 0xd0 indicates a response.

[0075] When these two types of PDU packets are found in the data stream, it can be explained that the communication of the above data stream at the application layer (RDP protocol) is session controlled through the X.224 protocol, thereby confirming that the above data stream is an RDP data stream.

[0076] In the RDP brute force detection method and detection device of the above-mentioned embodiment of the present disclosure, by verifying whether the data flow complies with the TPKT protocol, X.224 protocol and RDP protocol layer by layer, the real RDP session flow can be effectively identified from the network traffic. Since brute force attacks usually generate a large number of invalid connections or traffic that does not comply with the protocol specifications, this multi-layer verification mechanism can effectively screen out legitimate RDP traffic, thereby reducing misjudgments and missed judgments; by detecting the alternating pattern of request and response packets, abnormal request patterns can be quickly identified, thereby improving the response speed and real-time performance of brute force detection.

[0077] In a possible implementation of the above embodiment, determining the RDP protocol version corresponding to the RDP data stream includes:

[0078] The third data packet of the RDP data stream is obtained, and the type of handshake information in the third data packet is detected. When it is determined that the third data packet contains TLS handshake information, the RDP protocol corresponding to the RDP data stream is determined to be the first version; when it is determined that the third data packet contains SSL handshake information, the RDP protocol corresponding to the RDP data stream is determined to be the second version.

[0079] In this embodiment, the third data packet of the RDP data stream may include protocol negotiation information between the RDP server and the client.

[0080] When it is determined that the third data packet contains TLS handshake information, determining that the RDP protocol corresponding to the RDP data stream is the first version may include: when it is determined that the third data packet contains TLS handshake information, determining that the RDP protocol corresponding to the RDP data stream is the TLS protocol.

[0081] As an example, when the field 0x03 0x01 is detected in the third data packet, it can be determined that the RDP protocol corresponding to the RDP data stream is the TLS protocol version 1.0. Among them, 0x03 0x01 is only used as an example, and the specific TLS protocol version judgment byte in the third data packet is not specifically limited here.

[0082] When it is determined that the third data packet contains SSL handshake information, determining that the RDP protocol corresponding to the RDP data stream is the second version may include: when it is determined that the third data packet contains SSL handshake information, determining that the RDP protocol corresponding to the RDP data stream is the SSL protocol.

[0083] As an example, when the field 0x02 is detected in the third data packet, it can be determined that the RDP protocol corresponding to the RDP data stream is the SSL protocol version 1.1. Among them, 0x02 is only used as an example, and the specific SSL protocol version judgment byte in the third data packet is not specifically limited here.

[0084] In the RDP brute force cracking detection method and detection device of the above-mentioned embodiment of the present disclosure, by analyzing the handshake information in the third data packet, the protocol version used by the RDP session can be directly confirmed, avoiding detailed analysis of the entire data stream and improving recognition efficiency; different versions of the RDP protocol use different encryption mechanisms (TLS and SSL), and their encryption strength and handshake process are different. After identifying the protocol version, the corresponding brute force cracking detection strategy can be adopted based on its characteristics to improve detection efficiency and accuracy.

[0085] In a possible implementation of the above embodiment, a first detection method is used to detect whether there is brute force cracking between the RDP server and the client, including:

[0086] Detect whether there is a TLS payload in the RDP data stream between the RDP server and the client. When the detection result shows that there is a TLS payload in the RDP data stream, increase the value of the TLS payload counter. When the TLS payload exists, it can indicate that a secure connection is established between the RDP server and the client.

[0087] When the detection result is that there is no TLS payload in the RDP data stream and the value of the TLS payload counter is less than a first preset threshold, marking the RDP data stream as a short session record;

[0088] When the number of short session records within the preset time threshold is greater than the second preset threshold, it is determined that there is a possible brute force crack between the RDP server and the client.

[0089] In this embodiment, when the presence of a TLS payload is detected in the RDP data stream, it can be indicated that the RDP server and the client have completed a handshake through TLS, established a secure connection, and started encrypted data transmission.

[0090] The TLS payload counter can be defined as a statistical variable that tracks and records the number of TLS payload packets in the RDP data stream. Whenever a TLS payload packet is detected in the RDP data stream, the counter value is increased by 1 to accumulate the total number of payload packets. The increment of the counter reflects the activity of TLS traffic in the RDP connection. Continuous growth can indicate that the TLS session in the data stream is proceeding normally. If the growth is interrupted or the count stops suddenly, it may mean that the session is interrupted or an abnormal situation occurs.

[0091] Here, the TLS payload counter can be used in brute force detection to determine whether there are abnormal attempts (brute force attacks usually result in frequent transmission of data packets, and the TLS payload counter increases faster). That is, if the counter's growth rate is abnormal, it may indicate the presence of possible brute force behavior.

[0092] When the detection result is that there is no TLS payload in the RDP data stream and the value of the TLS payload counter is less than a first preset threshold, marking the RDP data stream as a short session record can include: detecting whether the security connection of the RDP data stream is disconnected, and when the connection is disconnected, checking the statistical value of the TLS payload counter, if the statistical value of the TLS payload counter is less than the first preset threshold, marking the session of the above-mentioned secure connection as a short session, and recording the time when the session is disconnected.

[0093] When the number of short session records within a preset time threshold is greater than a second preset threshold, determining that there is a possible brute force attack between the RDP server and the client may include: confirming a preset observation time window, counting the number of disconnected short sessions in the preset observation time window, and when the number of short sessions is greater than the second preset threshold, marking the current RDP data stream as suspected of a brute force attack.

[0094] Here, a short session can refer to an RDP connection session with a shorter connection duration and less TLS payload. Since brute force attackers test different username and password combinations through multiple and rapid attempts, each attempt will generate a short session connection, and most incorrect attempts will be rejected in a short time and cause the session to be disconnected. During the brute force cracking process, the number of short sessions will increase significantly. Therefore, the number of short sessions can be used to determine whether there is a possible brute force cracking between the RDP server and the client.

[0095] In the RDP brute force cracking detection method and detection device of the above-mentioned embodiment of the present disclosure, the TLS payload counter and short session statistics are used to distinguish normal user sessions from malicious brute force cracking behaviors. The detection method based on connection frequency and session characteristics effectively reduces the false alarm rate and improves the accuracy of detection. By increasing and decreasing the TLS payload counter, it is possible to quickly identify whether a secure session has been established in the connection, so that while recording the secure connection, the misjudgment of the normal encrypted session can be eliminated, making the detection more intelligent.

[0096] In a possible implementation of the above embodiment, a second detection method is used to detect whether there is brute force cracking between the RDP server and the client, including:

[0097] Obtaining a session end packet and a sequence number of the session end packet in the RDP data stream, wherein the session end packet is sent by the client to the RDP server;

[0098] When the sequence number of the session ending data packet belongs to the first sequence range, it is determined that there is a possible brute force crack between the RDP server and the client, and the brute force crack statistics table is updated;

[0099] When the sequence number of the session ending data packet belongs to the second sequence range and the brute force cracking statistics table is greater than the third preset threshold, it is determined that there is a successful brute force cracking between the RDP server and the client.

[0100] In this embodiment, when a client using the SSL protocol makes a brute force cracking attempt, it will send a session end data packet when ending the session, and the session end data packet is used to terminate the current session connection.

[0101] Furthermore, when a client using the SSL protocol sends a RST data stream, the sequence number of the data packet in the RST data stream is usually within the first sequence range. When the brute force cracking is successful, the sequence number of the data packet sent by the client is usually within the second sequence range. The sequence number can be used to indicate the total amount of payload bytes sent by the current data packet.

[0102] Therefore, it is possible to judge whether there is a possible brute force crack and a successful brute force crack according to the range of the sequence number of the session end data packet.

[0103] When the sequence number of the session-ending data packet belongs to the first sequence range, determining that there is a possible brute force crack between the RDP server and the client, and updating the brute force crack statistics table may include: when the sequence number of the session-ending data packet is near 1663, determining that there is a possible brute force crack between the RDP server and the client, and updating the brute force crack statistics table.

[0104] When the sequence number of the session-ending data packet belongs to the second sequence range and the brute force cracking statistics table is greater than the third preset threshold, determining that a successful brute force crack exists between the RDP server and the client may include: when the sequence number of the session-ending data packet is around 2373 and the brute force cracking statistics table is greater than the third preset threshold, determining that a successful brute force crack exists between the RDP server and the client.

[0105] Here, the data around 1663 and 2373 are obtained through experimental statistics and are only used as examples for explanation. In the process of brute force cracking, the attacker will send different RST packets at different attack stages, causing the sequence number to change from around 1663 to around 2373.

[0106] Furthermore, when the sequence number of the session-ending packet is near 1663, it may indicate a possible brute force attack or an incorrect user login password, and the value of the brute force attack statistics table is increased by 1. The brute force attack statistics table may be a data table or data structure used to record and analyze data related to brute force attack detection, and is mainly used to track potential brute force attacks in RDP connections.

[0107] Furthermore, the third preset threshold may refer to a standard for measuring the frequency of brute force cracking activities. When the records in the brute force cracking statistics table exceed the threshold, it indicates that an abnormally large number of connection attempts have occurred within a specific time period.

[0108] In the RDP brute force cracking detection method and detection device of the above-mentioned embodiment of the present disclosure, by analyzing the end session data packets in the RDP data stream, paying attention to the relationship between the amount of bytes sent in each data stream and the brute force cracking, combining the data of the sequence number range and the brute force cracking statistics table, accurately determine whether there is brute force cracking behavior, and respond in time, thereby improving the timeliness of brute force cracking detection; accurately determine whether the brute force cracking is successful or not, which can reduce unnecessary alarms and misjudgments to a certain extent, and improve the stability of system detection; by simultaneously detecting possible brute force cracking and successful brute force cracking, the comprehensiveness of detection is improved.

[0109] In a possible implementation of the above embodiment, the method further includes:

[0110] When there is a possible brute force attack and / or a successful brute force attack between the RDP server and the client, an alarm notification is sent to the RDP server and the client.

[0111] In this embodiment, when there is a possible brute force crack and / or a successful brute force crack between the RDP server and the client, an alarm notification is sent to the RDP server and the client, which may include: when a brute force crack success mark is triggered, a brute force crack success alarm is triggered to indicate that an attack exists; when a possible brute force crack mark is triggered, a possible brute force crack alarm is triggered to indicate that a brute force crack attack may be ongoing.

[0112] As an example, a brute force cracking alarm may include at least one of the following: alarm type, attack source IP, target IP, connection time information, brute force cracking statistics, and security recommendations. The level of brute force cracking alarm may include high, medium, and low, where high may indicate that the brute force cracking is successful and may have caused data leakage or system intrusion, medium may indicate that there is a possibility of brute force cracking and the cracking is in progress, and low may indicate that there are certain brute force cracking attempts, but they have not reached the level of success.

[0113] Furthermore, the brute force cracking alarm may be sent in a manner including, but not limited to, email notification, SMS notification, and push notification.

[0114] In the RDP brute force cracking detection method and detection device of the above-mentioned embodiment of the present disclosure, through in-depth analysis of the RDP data stream, an alarm notification is automatically triggered when a brute force cracking attack occurs, which can effectively improve the security of the RDP server and quickly respond to potential attacks.

[0115] In one embodiment, the method for detecting whether there is a brute force crack may also include: detecting the number of concurrent connections in the RDP data stream, and if the number of concurrent connections is greater than a fourth preset threshold, determining that there is a possible brute force crack between the RDP server and the client.

[0116] In this embodiment, since the normal connection between the RDP server and the client, whether it is transferring files or sharing interfaces, the RDP traffic will not be multi-threaded concurrently, and brute force cracking is mostly multi-threaded to increase the cracking speed. Therefore, it is possible to determine whether there is suspicion of brute force cracking by detecting the number of concurrent connections in the RDP data stream.

[0117] Here, by detecting the number of concurrent connections in the RDP data stream, concurrent brute force attacks can be effectively identified to ensure that possible attack behaviors are discovered in a timely manner.

[0118] In one embodiment, Figure 2 This is a schematic diagram of the RDP protocol verification process of an RDP brute force cracking detection method provided by the embodiment of the present disclosure, which is applied to the above Figure 1b The RDP brute force cracking detection method shown in the figure may include the following steps:

[0119] Step S201, obtaining a TCP data packet in an RDP data stream;

[0120] Step S202, whether TCP.payload[0]=0X03&&TCP.payload[1]=0X00 is satisfied, if so, proceed to step S203, if not, proceed to step S204;

[0121] Here, the first byte and the second byte in the TCP payload are determined. If the first byte is 0x03 and the second byte is 0x00, it is determined that the RDP data stream complies with the TPKT protocol. If not, it is determined that the RDP data stream does not comply with the TPKT protocol.

[0122] Step S203, whether TCP.payload[5]=0xe0||TCP.payload[5]=0xd0 is satisfied. If TCP.payload[5]=0xe0 is satisfied, proceed to step S205. If TCP.payload[5]=0xd0 is satisfied, proceed to step S206. If not, proceed to step S204.

[0123] Here, it is determined whether the sixth byte in the TCP payload is 0xe0 or 0xd0. If so, it is determined that the RDP data stream complies with the X.224 protocol. If not, it is determined that the RDP data stream does not comply with the X.224 protocol.

[0124] Step S204, the RDP data stream does not conform to the RDP protocol;

[0125] Here, when the RDP data stream does not conform to the TPKT protocol, or conforms to the TPKT protocol but does not conform to the X.224 protocol, it is determined that the RDP data stream does not conform to the RDP protocol;

[0126] Step S205, the RDP data stream complies with the RDP protocol and is a request;

[0127] Here, when TCP.payload[5]=0xe0, the RDP data stream complies with the RDP protocol, and the TCP payload represents the request;

[0128] Step S206, the RDP data stream complies with the RDP protocol and is a response;

[0129] Here, when TCP.payload[5]=0xd0, the RDP data stream complies with the RDP protocol and the TCP payload represents the response.

[0130] In one embodiment, Figure 3 This is a schematic diagram of a first detection method flow of an RDP brute force cracking detection method provided by the present disclosure, which is applied to the above Figure 1b The RDP brute force cracking detection method shown in the figure may include the following steps:

[0131] Step S301, obtaining a TCP data packet in an RDP data stream;

[0132] Step S302, determine whether it complies with the TPKT protocol; if so, proceed to step S303, if not, end;

[0133] Step S303, determine whether it complies with the X.224 protocol; if so, when the sixth byte in the TCP payload is 0xe0, go to step S305, when the sixth byte in the TCP payload is 0xd0, go to step S306;

[0134] Step S304, determine whether it is a TLS payload; if so, proceed to step S307, if not, proceed to step S308;

[0135] Here, the presence of a payload in the TCP packet is detected;

[0136] Step S305, marking the request as sent;

[0137] Here, the TCP load characterization request is determined and marked as a sent request;

[0138] Step S306, marking the X.224 connection as successful;

[0139] Here, the TCP payload characterization response is determined, marking the X.224 connection as successful, i.e., establishing a secure connection;

[0140] Step S307, determine whether an X.224 connection (ie, a secure connection) is established; if so, proceed to step S309; ​​if not, proceed to step S310;

[0141] Here, it is determined that an X.224 connection is established based on the presence of a payload in the TCP packet;

[0142] Step S308, determine whether the security connection is disconnected, if so, proceed to step S310;

[0143] Here, it is determined that an X.224 connection is established and then disconnected based on the absence of a payload in the TCP packet;

[0144] Step S309, TLS payload counter +1;

[0145] Step S310, the RDP protocol is compliant and the TLS payload counter is less than the first threshold; if so, proceed to step S311, if not, proceed to step S312;

[0146] Step S311, marking as a short session record and recording the time;

[0147] Step S312, determining whether the number of short conversation records within the preset time threshold is greater than a second preset threshold; if so, proceeding to step S313;

[0148] Step S313: determine whether there is a possible brute force attack.

[0149] In one embodiment, Figure 4 This is a flow chart of a second detection method of an RDP brute force cracking detection method provided by the present disclosure, which is applied to the above Figure 1b The RDP brute force cracking detection method shown in the figure may include the following steps:

[0150] Step S401, obtaining a session packet of the SSL version;

[0151] Here, when the RDP protocol complies with the SSL version, the session packet of the SSL version is obtained;

[0152] Step S402: Whether the client ends the session;

[0153] Step S403, determining the sequence number of the session end data packet; when the sequence number is around 1633, proceeding to step S404; when the sequence number is around 2373 and the counter is greater than a third preset threshold, proceeding to step S404;

[0154] Step S404: determine that there is a possible brute force attack, and increase the counter by 1;

[0155] Step S405, determining whether there is a successful brute force attack.

[0156] In one embodiment, a detection device 50 is provided, which corresponds one-to-one to the RDP brute force cracking detection method in the above embodiment. Figure 5 As shown, the detection device 50 includes a first determination module 501, a second determination module 502, a first detection module 503 and a second detection module 504, wherein each functional module is described in detail as follows:

[0157] The first determination module 501 is used to obtain the transmission data between the RDP server and the client, and use a preset method to determine whether the transmission data is an RDP data stream;

[0158] The second determination module 502 is used for, when the transmission data is an RDP data stream, determining the RDP protocol version corresponding to the RDP data stream when the result of performing RDP protocol verification on the RDP data stream is verification passed, where the RDP protocol version is used to indicate whether the RDP protocol that the RDP data stream complies with is the first version or the second version;

[0159] A first detection module 503 is used to detect whether there is a brute force crack between the RDP server and the client by using a first detection method when the RDP protocol version of the RDP data stream is the first version;

[0160] The second detection module 504 is used to detect whether there is brute force cracking between the RDP server and the client by using a second detection method when the RDP protocol version of the RDP data stream is the second version.

[0161] In one embodiment, the first determination module 501 is used to obtain the first data packet after the TCP handshake in the transmission data, determine whether the first data packet contains a preset keyword, and when the first data packet contains the preset keyword, determine that the transmission data is an RDP data stream;

[0162] The detection device 50 further includes a third determination module 505, wherein:

[0163] The third determination module 505 is used to determine that the RDP data stream is an RDP negotiation request packet sent by the client to the RDP server when the byte at the first preset position of the RDP data stream is a first value; and to determine that the RDP data stream is an RDP negotiation response packet returned by the RDP server to the client when the byte at the first preset position of the RDP data stream is a second value.

[0164] In one embodiment, the second determination module 502 is used to determine whether the RDP data stream complies with the TPKT protocol based on the structural characteristics of the TPKT protocol;

[0165] When the RDP data stream complies with the TPKT protocol, based on the structural characteristics of the X.224 protocol, it is determined whether the RDP data stream complies with the X.224 protocol; the X.224 protocol depends on the TPKT protocol;

[0166] When the RDP data stream complies with the X.224 protocol, it is determined that the result of performing RDP protocol verification on the RDP data stream is verification passed, wherein verification passed indicates that the RDP data complies with the RDP protocol; and the RDP protocol depends on the X.224 protocol.

[0167] In one embodiment, the second determination module 502 is used to obtain the third data packet of the RDP data stream, detect the type of handshake information in the third data packet, and when it is determined that the third data packet contains TLS handshake information, determine that the RDP protocol corresponding to the RDP data stream is the first version; when it is determined that the third data packet contains SSL handshake information, determine that the RDP protocol corresponding to the RDP data stream is the second version.

[0168] In one embodiment, the first detection module 503 is used to detect whether there is a TLS payload in the RDP data stream between the RDP server and the client, and when the detection result is that there is a TLS payload in the RDP data stream, increase the value of the TLS payload counter; the presence of the TLS payload can indicate that a secure connection is established between the RDP server and the client;

[0169] When the detection result is that there is no TLS payload in the RDP data stream and the value of the TLS payload counter is less than a first preset threshold, marking the RDP data stream as a short session record;

[0170] When the number of short session records within the preset time threshold is greater than the second preset threshold, it is determined that there is a possible brute force crack between the RDP server and the client.

[0171] In one embodiment, the second detection module 504 is used to obtain a session end data packet in the RDP data stream and a sequence number of the session end data packet, wherein the session end data packet is sent by the client to the RDP server;

[0172] When the sequence number of the session ending data packet belongs to the first sequence range, it is determined that there is a possible brute force crack between the RDP server and the client, and the brute force crack statistics table is updated;

[0173] When the sequence number of the session ending data packet belongs to the second sequence range and the brute force cracking statistics table is greater than the third preset threshold, it is determined that there is a successful brute force cracking between the RDP server and the client.

[0174] In one embodiment, the detection device 50 further includes an alarm module 506, wherein:

[0175] The alarm module 506 is used to send an alarm notification to the RDP server and the client when there is a possible brute force crack and / or a successful brute force crack between the RDP server and the client.

[0176] It should be noted that: when the detection device provided in the above embodiment implements the corresponding RDP brute force cracking detection method, only the division of the above program modules is used as an example. In actual application, the above processing can be assigned to different program modules as needed, that is, the internal structure of the above system can be divided into different program modules to complete all or part of the above-described processing. Figure 1b The embodiments of the method shown belong to the same concept, and the specific implementation process is detailed in the method embodiments, which will not be repeated here.

[0177] The present disclosure also provides a computer device having the above Figure 5 The detection device shown.

[0178] See 6, Figure 6 is a schematic diagram of the structure of another detection device provided by an embodiment of the present disclosure, such as Figure 6 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 6 A processor 10 is taken as an example.

[0179] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0180] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0181] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0182] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0183] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 6 The example of connecting through bus is taken in the following.

[0184] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0185] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0186] The embodiments of the present disclosure also provide a computer-readable storage medium. The above-mentioned method according to the embodiments of the present disclosure can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium and downloaded through a network, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state drive, etc.; further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0187] A part of the present disclosure may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present disclosure through the operation of the computer. Those skilled in the art should understand that the existence of computer program instructions in computer-readable media includes, but is not limited to, source files, executable files, installation package files, etc., and accordingly, the way in which computer program instructions are executed by a computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to the computer.

[0188] Although the embodiments of the present disclosure have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A RDP brute force cracking detection method, characterized in that: The method comprises: Acquire transmission data between the RDP server and the client, and determine whether the transmission data is an RDP data stream using a preset method; When the transmission data is the RDP data stream, when the result of performing RDP protocol verification on the RDP data stream is that the verification passes, determining the RDP protocol version corresponding to the RDP data stream, the RDP protocol version being used to indicate whether the RDP protocol to which the RDP data stream conforms is the first version or the second version; When the RDP protocol version of the RDP data stream is the first version, using a first detection method to detect whether there is a brute force crack between the RDP server and the client; When the RDP protocol version of the RDP data stream is the second version, a second detection method is used to detect whether there is brute force cracking between the RDP server and the client.

2. The method according to claim 1, characterized in that: The predetermined method is used to determine whether the transmission data is an RDP data stream, which is implemented based on the following steps: Obtaining a first data packet after a TCP handshake in the transmission data, determining whether the first data packet contains a preset keyword, and determining that the transmission data is an RDP data stream when the first data packet contains the preset keyword; The method further includes: when the byte at the first preset position of the RDP data stream is a first value, determining that the RDP data stream is an RDP negotiation request packet sent by the client to the RDP server; When the byte at the first preset position of the RDP data stream is a second value, it is determined that the RDP data stream is an RDP negotiation response packet returned by the RDP server to the client.

3. The method according to claim 1, characterized in that The RDP protocol verification is performed on the RDP data stream, which is implemented based on the following steps: Based on the structural characteristics of the TPKT protocol, determining whether the RDP data stream complies with the TPKT protocol; When the RDP data stream complies with the TPKT protocol, determining whether the RDP data stream complies with the X.224 protocol based on the structural characteristics of the X.224 protocol; the X.224 protocol depends on the TPKT protocol; When the RDP data stream complies with the X.224 protocol, it is determined that the result of performing RDP protocol verification on the RDP data stream is verification passed, wherein the verification passed indicates that the RDP data complies with the RDP protocol; and the RDP protocol depends on the X.224 protocol.

4. The method according to claim 3, characterized in that Determining the RDP protocol version corresponding to the RDP data stream includes: Obtain a third data packet of the RDP data stream, detect the type of handshake information in the third data packet, and when it is determined that the third data packet contains TLS handshake information, determine that the RDP protocol corresponding to the RDP data stream is the first version; when it is determined that the third data packet contains SSL handshake information, determine that the RDP protocol corresponding to the RDP data stream is the second version.

5. The method according to claim 4, characterized in that The first detection method is used to detect whether there is brute force cracking between the RDP server and the client, including: Detecting whether there is a TLS payload in the RDP data stream between the RDP server and the client, and when the detection result is that the TLS payload exists in the RDP data stream, increasing the value of the TLS payload counter; when the TLS payload exists, it can indicate that a secure connection is established between the RDP server and the client; When the detection result is that the TLS payload does not exist in the RDP data stream and the value of the TLS payload counter is less than a first preset threshold, marking the RDP data stream as a short session record; When the number of the short session records within the preset time threshold is greater than a second preset threshold, it is determined that there is a possible brute force crack between the RDP server and the client.

6. The method according to claim 5, characterized in that The second detection method is used to detect whether there is brute force cracking between the RDP server and the client, including: Acquire a session end packet in the RDP data stream and a sequence number of the session end packet, wherein the session end packet is sent by the client to the RDP server; When the sequence number of the session end data packet belongs to the first sequence range, it is determined that there is a possible brute force crack between the RDP server and the client, and the brute force crack statistics table is updated; When the sequence number of the session end data packet belongs to the second sequence range and the brute force cracking statistics table is greater than a third preset threshold, it is determined that a successful brute force cracking exists between the RDP server and the client.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: When there is a possible brute force crack and / or a successful brute force crack between the RDP server and the client, an alarm notification is sent to the RDP server and the client.

8. A detection device, characterized in that: The device comprises: A first determination module is used to obtain transmission data between the RDP server and the client, and to determine whether the transmission data is an RDP data stream by using a preset method; A second determination module is configured to, when the transmission data is the RDP data stream, determine the RDP protocol version corresponding to the RDP data stream when the result of performing RDP protocol verification on the RDP data stream is verification passed, wherein the RDP protocol version is used to indicate whether the RDP protocol to which the RDP data stream conforms is the first version or the second version; A first detection module, configured to detect whether there is a brute force crack between the RDP server and the client by using a first detection method when the RDP protocol version of the RDP data stream is the first version; The second detection module is used to detect whether there is brute force cracking between the RDP server and the client by using a second detection method when the RDP protocol version of the RDP data stream is the second version.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the RDP brute force cracking detection method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the RDP brute force cracking detection method according to any one of claims 1 to 7.

Images