Remote Login Session Analysis for Slow Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing remote desktop systems lack effective detection mechanisms for slow attack behaviors such as low-frequency and distributed brute force attacks, compromising the security of remote login systems.
Innovation Solution
An information processing method and apparatus that identifies session characteristics and security protocol types to determine login status by comparing session characteristics with thresholds, enabling detection of attack behaviors across multiple time scales and improving security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional remote desktop protocols are used without enhanced detection mechanisms, then the system maintains simplicity and ease of operation, but it fails to detect slow attack behaviors such as low-frequency and distributed brute force attacks
Solution Approach 1:
The patent segments the login detection process into multiple independent components: session characteristic identification, security protocol type identification, threshold determination, and login status determination. Each component operates independently but contributes to the overall detection system, allowing the complex security detection to be broken down into manageable, modular units that can be implemented and maintained separately.
Solution Approach 2:
The patent performs preliminary identification of session characteristics and security protocol types before making the final login status determination. By pre-identifying these attributes and pre-determining thresholds based on security protocol types, the system prepares detection criteria in advance, enabling faster and more accurate real-time login status assessment without adding complexity to the core authentication flow.
2Measurement precision
If session characteristic analysis is performed for every login attempt, then the precision of attack detection is improved, but the processing time and system resource consumption increase
Solution Approach 1:
The patent performs preliminary identification of session characteristics and security protocol types, and pre-determines thresholds based on security protocol types before the actual login status determination. This advance preparation allows the system to quickly compare pre-identified characteristics against pre-established thresholds, significantly reducing the time required for real-time login status assessment while maintaining high detection accuracy.
Solution Approach 2:
The patent applies different detection thresholds and analysis methods based on the specific security protocol type identified for each session. Rather than using a uniform detection approach for all logins, the system tailors the detection precision and threshold criteria to the specific protocol being used, optimizing the balance between detection accuracy and processing efficiency for each protocol type.
Data Source
Figure 1~2A
Figure 2B~3A
Figure 3B~3C
AI summary
Disclosed are an information processing method and apparatus, a device, and a storage medium. The method comprises: for a login behavior from a target source address, recognizing whether the type of a protocol used by a session corresponding to the login behavior is a target protocol type; if the type of the protocol used by the session corresponding to the login behavior is the target protocol type, parsing a data packet for the session on the basis of the target protocol type to extract session features of the session; and inferring the login state of the login behavior according to the session features.